The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

A system doesn't always need a complicated bug to let someone in. Sometimes, a blank password is enough. That's one of the bigger stories this week. And it gets worse when the tools meant to keep systems updated or running safely become part of the attack. Elsewhere, attackers are hiding inside normal web traffic, stealing credentials from network devices, and finding new uses for exposed systems. AI is helping some of them move faster, but old mistakes are doing plenty of the work too. Even forgotten settings and small changes made months ago are coming back to cause trouble. There's a lot packed into this week's news, including some strange research findings, fresh attacks, and a few warnings worth taking seriously. Here's the full recap. ⚡ Threat of the Week OpenSSH Flaw Sees Exploitation Attempts — Threat actors are attempting to exploit a recently disclosed security flaw impacting OpenSSH that can enable sign-ins to accounts that have no password set....

The login systems behind two car brands' mobile apps could be taken over completely, two security researchers found, allowing them to access any customer's account and, for an owner with a connected car, unlock the doors and start the engine. Both apps signed customers in through ForgeRock , an identity platform now part of Ping Identity , and on those servers the researchers reached an administrator console that still used its default password. They tested the full attack only on their own and consenting owners' cars in the United States, in February 2026, and both systems were fixed about two hours after they reported the problem. Shubham Shah and Sam Curry published their work late last week. They had started with the apps: both brands signed customers in through the same platform, which runs in two parts: one for login and one, called OpenIDM , that holds customer records. OpenIDM comes with a built-in administrator console powered by the Apache Felix tool. For...

Some people who set up a Keplr crypto wallet with their Google or Apple account have had money stolen by an attacker. Keplr uses a company called Web3Auth to run that Google and Apple sign-in. The attacker used a security flaw at that company to reach the wallets, both companies said late last week. Web3Auth then used the attacker's own route to empty other at-risk wallets before the attacker got to them, it said. It moved that money, with help from the wallet maker, into recovery wallets for safekeeping. So an empty balance may mean the money was rescued, not stolen. Wallets made with a recovery phrase (a backup list of 12 or 24 words) or a hardware wallet are not affected, the wallet maker said. It has paused Google and Apple sign-in while it investigates. What Affected Users Should Do The wallet maker has given this  user guidance  for accounts created with Google or Apple login: Do not send new funds to the account. Do not re-import the account or recr...

Everyone running LNbits , a free, open-source Bitcoin Lightning wallet system, should shut down their servers now because of a wave of attacks, the project said yesterday. It has several security fixes to release and asked operators to be careful until they are out. One operator said new accounts used an exploit to withdraw 2,285,545 satoshis, about 0.023 bitcoin, from his server before he could stop it. The shutdown notice came about 80 minutes after a first, narrower warning. That warning asked operators to disable Paywall, an add-on that makes people pay to view content, while the project looked into a possible bug. As of 09:00 UTC today, the project had not released a fixed version. On X, it had not canceled the notice, offered another option, or told operators how to check whether their servers were hit before they were shut down. Ben Arc, an LNbits developer, said in a  patch estimate  yesterday that patches "should be merged and available within 24-48hrs." Cou...

A single attacker using AI agents pulled emergency dispatch records covering seven Taipei districts, researchers at Acronis's Threat Research Unit said last week. The agents also found a Taipei fire department platform exposing patient data from 2018, including ECG readings and ambulance video footage, without a login. The researchers are highly confident that the attacker is a single person based in Hualien City, Taiwan. He aimed the agents at hundreds of organizations in at least 11 countries, including emergency services, banks, universities and military systems. The agents collected data or accessed systems at about 10 of them in Taiwan, Mexico and Thailand. The evidence comes from the attacker's own server, which initially appeared to be a misconfigured development system. It turned out to be his operational attack platform, containing more than 90,000 files, including the agents' conversations, his command history, hacking tools, credentials, and victims' d...

The OpenAI engineer who was arrested and charged last month for planting a covert audio recording device in the company's office has pleaded not guilty. According to reports from Bloomberg and CNBC , Saudi national Abdulrahman Alfozan made an appearance in San Francisco federal court on Friday, where he entered the plea. His next hearing is scheduled for November 17, 2026. If proven guilty, the 35-year-old faces a maximum of five years in prison and a $250,000 fine, followed by three years of supervised release. He has been held without bail since his arrest on October 9, 2026. Late last month, a grand jury indicted Alfozan on a single count of interception of oral communications. Prosecutors allege that the former OpenAI employee placed a "sophisticated recording device" in an executive OpenAI conference room in what has been described as an attempt to unlawfully record sensitive conversations. He was arrested three days before he, along with his wife and s...