The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of  eight intermediate certificate authority keys. Programs built on the new release will refuse connections to sites and services whose certificates were issued under those keys. The Go team says the keys belong to one certificate authority it has not named, and that it is blocking them because of "specific security concerns around their operation." It handled the fix on its  URGENT track , the one reserved for its most serious issues, and recommends upgrading immediately. Two days earlier, on October 17, Mozilla added six intermediate certificates issued by eMudhra's emSign Root TLS CA - G3 to  OneCRL , the list Firefox uses to block certificates. The Mozilla bug behind those entries is  closed to the public , and neither Mozilla nor Go has said what prompted its action. Whether Chrome, Apple, or Microsoft have taken simil...

The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic Treaty Organization (NATO). The Symantec Threat Hunter Team, which is tracking the activity cluster under the moniker Swallowtail , involved the use of a backdoor called HOOKEDGE and a previously undocumented loader that is designed to decrypt and run an encrypted payload in memory by using a cryptographic key that's supplied at runtime. Targets of the activity included a law enforcement agency, a naval shipbuilder, and a manufacturer of military aircraft engines – entities that hold information that could be of use to a foreign intelligence agency, the Broadcom-owned threat intelligence unit said. "During one attack against the naval shipbuilder, operators returned to a compromised host repeatedly over the course of a week in what appeared to be hands-on-keyboard activity,...

ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues to respond to a security incident that led to unauthorized access to application identities associated with Cloud Backup. The company said it has completed the following actions since it began rolling out mitigations on October 17 at 5:00 a.m. UTC, three days after the incident was first identified - Disabling affected application connections and suspending Cloud Backup. Suspending SaaS Security and Cloud Management as a precaution because they are integrated with Cloud Backup. Enlisting the help of independent third-party specialists for incident response and remediation. Enhancing administrative-access protections. Publishing technical guidance to help partners investigate and remediate potential unauthorized activity in their own and managed customer environments. ...

An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it, the cloud provider says. They were live on GitHub for up to 94 minutes, from 12:47 to 14:21 UTC, and reached only people who installed or updated the OVHcloud CLI during that window, via a path that checks for no hash, on macOS, Linux x86_64 or arm64, or Windows x86_64. OVHcloud deleted the swapped archives and published a clean  v0.16.0  that evening as an immutable release, whose files GitHub will not let anyone change. The source code, the release tag, and the company's build pipeline were not touched: the bad build was a plain go build of a later commit, uploaded straight onto releases published between April and September. Who Was Exposed On v0.15.0, the attac...

Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as CVE-2026-110936 (CVSS v4 score: 8.4), could allow an attacker to place a specially-crafted DLL in a directory the application searches, resulting in execution of malicious code with the same privileges as the affected service. "The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path," Siemens said in an advisory. "This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application." The issue has been patched in version 4.0.9.8. Huntress Labs researcher Jose Oregon has been credited with discovering and reporting the shortcoming. In a separate alert, Siemens said attackers have abused a genuine ...

A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco office to allegedly steal sensitive secrets. In a new court filing Sunday, prosecutors revealed that Abdulrahman Alfozan, a 35-year-old Saudi national, was "in frequent communications via WhatsApp with a member of the Saudi Royal Family" throughout 2025 and 2026. Alfozan is said to have communicated with the Saudi royal as recently as October 5, 2026, four days before he was arrested. "Among other things, the individual told the defendant that an artificial intelligence initiative was being launched in Saudi Arabia and wanted the defendant to join it," the filing reads. "In May 2026, the individual told the defendant, 'Saudi needs you more then [sic] the US!' to which the defendant responded '100,' indicating he agreed." The S...