The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability , which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October 28, 2026. "This is due to predictable, web-accessible staging paths used during full-package core upgrades," Wordfence said . "This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window." The WordPress security company noted that successful exploitation requires an "attacker to hit a very narrow window while WordPress is unpacking a complete Core update." The issue boils down to the fact that affected versions unpack new files part of a full-package Core update into a predictable directory under "wp-c...

A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase. Trezor said in a  blog post  on October 30 that the report came in two days earlier from a customer in Indonesia. He bought the wallet from CryptoBilis in August, through the marketplace Tokopedia. The board sits between the wallet's main board and its screen, with a cellular module and an antenna, according to the report. It reads the screen, including the recovery phrase (Trezor calls it the wallet backup), and sends it out whenever the device is plugged in. Trezor has the customer's photos and description and has interviewed him on a video call. It is arranging for the wallet to be sent to its lab. Trezor find...

The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything.  Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application the business depends on. Without evidence, the recommendation waits.  Safe remediation answers that hesitation with evidence. It tests the proposed action against your environment, applies the approved change, and confirms the result. Security and operations teams decide together, with facts.  The Cost of Leaving Protection in Detect  Many organizations already own protection they don’t enforce. Signatures sit inactive or in Detect mode while teams weigh false positives, inspection capacity, and business continuity. Meanwhile, applications and traffic patterns change, excep...

Ahmad Umar Agha , a Syrian Electronic Army hacker known online as " Th3Pr0 ," has been  sentenced by a U.S. federal court  to 42 months in prison for his role in a hacking conspiracy that targeted Western news outlets. The conspiracy was organized and led by members of former Syrian President Bashar al-Assad's inner circle, including the commander of Syria's General Intelligence Directorate, the U.S. Justice Department said on October 29. The pro-Assad Syrian Electronic Army began its attacks in 2011. Its members sent phishing emails to steal employees' passwords, then used those passwords to deface websites, redirect web traffic, and hijack social media accounts, according to a  2014 FBI affidavit . On April 23, 2013, the group hijacked the Associated Press's Twitter account and posted a false report that President Barack Obama had been injured in two explosions at the White House. Twitter's message confirming a password reset for that account w...

Cybersecurity researchers have disclosed that a trojanized version of Anthropic's official Claude Code extension was distributed through the Cursor Marketplace as a legitimate update, attempting to install a persistent SSH backdoor on affected systems. The malicious update, version 2.1.313, was distributed under the extension's legitimate publisher identity, prompting Cursor to temporarily shut down its marketplace to remove the compromised package. The exact method attackers used to introduce the unauthorized update remains unclear. "We identified a security incident affecting a modified Claude Code VS Code extension accessed through our Cursor IDE extension marketplace, impacting at most 5,000 users," Cursor said . "This malicious version of the extension was not developed by Anthropic. It does not impact other extensions downloaded from the cursor[.]com/marketplace, Grok Bot, Grok, or our other SpaceXSI product. However, Cursor's statement that the...

Drupal has warned that threat actors are exploiting a "highly critical" security flaw in its Commerce Core component. The vulnerability, tracked as CVE-2026-118539 (CVSS score: N/A), is a case of missing authorization affecting Commerce Core versions from 0.0.0 to 2.41 and from 3.0.0 to 3.3.13. "This module enables you to sell goods and services to customers through an included shopping cart and checkout form or through decoupled applications via APIs," Drupal said in an advisory. "The module doesn't sufficiently protect certain routes and entity fields, leading to an access bypass that may financially impact the vendor." The open-source content-management framework acknowledged that the vulnerability is being "actively exploited in the wild," but provided no specifics about the nature of the activity or the extent of the campaign. Users are being recommended to update to the latest version - Version 3.x - Upgrade to Commerc...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Cisco and GitLab software to its Known Exploited Vulnerabilities ( KEV ), citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-97229 (CVSS score: 10.0) - An integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration due to insufficient regular expression validation. CVE-2026-76418 (CVSS score: 8.6) - An unchecked return value to NULL pointer dereference vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial-of-service (DoS) condition. The devel...

Cryptocurrency giant Binance said on Thursday that a "security incident" on its platform has impacted about $6.3 billion worth of assets. The world's biggest cryptocurrency exchange said nearly $3 billion of those assets have been frozen on-chain so far.  Tether and Circle said they have frozen more than 1.567 billion USDT and 800 million USDC related to the incident, respectively. The Arbitrum Security Council is said to have executed a transaction to freeze about $30.5 million from the Binance Exploit.  "Initial investigation suggests that the security incident may involve a compromised DevOps engineer's laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions," Binance said in an update. The company said there is no evidence of a wallet private key leak, adding it will cover all losses from the Secure Asset Fund for Users ( SAFU ) fund and its own funds. Out of an abundance of c...