The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

A fix for CVE-2026-83844 , a remote code execution flaw in Windows Paint, is now in the Microsoft Store. Paint gets this fix only through a Store update, not through Windows updates. The fixed build, 11.2609.401.0, was the newest Paint build in all ten countries The Hacker News checked today. The flaw is an out-of-bounds read that could let an attacker run code over a network. Microsoft rates it as Important, with a CVSS score of 8.1, and says that a successful attack requires a deep understanding of the target system. The flaw was not known to be exploited or publicly disclosed when the company published it on October 13. Brian Vitko of RFF, a device-management software maker, checked which Paint builds the Store offered in six countries earlier this week. He found that the newest in each was 11.2605.81.0, a build without the fix. His test virtual machine has since moved to the fixed build on its own, through Store auto-update. That is one machine, and how quickly other PCs w...

A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test. The attack needs Dispatch , a Claude feature that lets people send tasks from their phone to Claude Desktop. The flaw that makes this possible can still be exploited, the researchers said earlier this week. Claude Desktop is an AI agent that can run commands on the computer where it is installed. The researchers found that Dispatch also accepted an ordinary signed-in session on claude.ai, the Claude website, even though the site showed no link to it. That let an extension running on the site send Claude Desktop instructions as if the user had sent them. The researchers say Anthropic, the company that makes Claude, told them on October 13 that Dispatch would be retired, with the end of October as the target. The Dispatch help page, last updated late last week, does not mention a retire...

An update on Athena, and some unsolicited predictions on what's coming next On Saturday, Dario Amodei published We Must Pace the Frontier . I agree with him. Go read it if you haven't. I've spent the summer looking at what these models find, and the gap he describes between what they can do and what the rest of us are ready for is the one I've been staring at since May. The hardest piece of his plan is the one that asks governments to coordinate. They're in a difficult spot: regulate too little and a US company accidentally builds the weapon, regulate too much and it gets built somewhere else, and open source isn't governable either way. Where governments can act is on consumption: not what the models can do, but what happens to what they find. Who gets a vulnerability first, how fast a fix reaches the people running the code, whether the operators who can't move on an attacker's timeline get a head start. That's what Gold Eagle is. It matters...

Blockchain analysis firm Chainalysis has revealed that its ongoing investigation into the agentic cyber attack targeting its systems also exposed names, usernames, password hashes and live tokens for all users. "While we investigated, we removed access to Reactor and Data Solutions," the company said. "At this time we continue to have no evidence that any investigations data has been accessed or Chainalysis attribution data has been manipulated." Chainalysis said it has implemented additional proactive monitoring systems to detect unusual activity, adding it took the Know Your Transaction (KYT) user interface and API offline, alongside other address screening products and the login page. Previously, Chainalysis said it was probing what it described as an "ongoing multi-front cyber attack," leading to the discovery of an "on-path attack" that exposed a subset of customer passwords. The company said the attack vector has since been addres...

A backdoor has been found hiding in the web server that runs Control Web Panel (CWP), a free panel for managing Linux hosting servers, researchers at QiAnXin's XLab said this week. The backdoored web server executes commands that attackers send via web requests, and those requests never appear in its access logs. Installing it takes root access, so the attackers must already control the server. The researchers, who named the backdoor cwpdoor , captured its installer, a shell script posing as a version update, on June 29. The installer handles only two versions of that web server, cwpsrv 1.15.10 and 1.24.0. The researchers do not yet know how attackers get the root access the installer needs. On September 30, an archive holding a copy of the backdoor was uploaded to VirusTotal from Brazil. The researchers say this indicates that "real victims already exist in the wild." They give no count of infected servers. The backdoor is cwpsrv itself, rebuilt with extra code...

Two flaws in Barracuda's Email Security Gateway , an email-filtering appliance, can be chained to run commands on it as root, its highest level of access, with no login required. The company released patches on Monday, and the security firm watchTowr detailed the attack chain on Thursday. One flaw, CVE-2026-116606 , is an authorization bypass. An unauthenticated attacker can use it to restore a crafted configuration backup and change the appliance's global settings. The other, CVE-2026-111560 , is a command injection. It runs commands as root but normally needs an administrator account, and on the Email Security Gateway the bypass gives an attacker that access. Chained, the two let an attacker reach root with no login. Affected Products and Fixes The authorization bypass affects only the Email Security Gateway. The command injection reaches five other products, but on those it still needs an administrator account. Mandiant, which assigned the two CVE records, rates...