The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

Google's Gemini model has become the latest artificial intelligence (AI) system to access the internet and break into other companies during a cybersecurity evaluation. The development was first reported by The Wall Street Journal. The incidents occurred in May 2026 as part of a test run conducted by Israeli company Irregular. The evaluation partner was also involved in similar hacks disclosed by OpenAI, Anthropic, and Meta. According to the Journal, the model gained access to a protected system after repeatedly guessing its password. Two other cases related to the model finding credentials in a public repository, allowing it to obtain unauthorized access to protected systems. However, unlike other incidents observed in the case of Anthropic and OpenAI, the Gemini model ended the intrusion after finding that it had breached a real company's system. Irregular is said to have notified Google of the incidents in July 2026. In a report published last month, Irregular pinn...

An attacker copied about 170 of CrowdSec's private GitHub repositories on May 22 using the account of an employee who had just left, CrowdSec said on September 18. The French security company had kept his GitHub access open. CrowdSec says his laptop was compromised in May's  supply chain attack on TanStack , in which malicious versions of TanStack's npm packages stole credentials from developers' machines. The code appeared on an online forum on September 16. Along with the source code, it contained the email addresses of 83 CrowdSec users and the names, email addresses, and investment context of 51 potential investors from 2020, the company said. CrowdSec says the account was used only to copy code, that its infrastructure and databases were not accessed, and that no code was changed. How the Code Was Taken On May 11, 84 malicious versions of 42 TanStack npm packages were published. The compromise is tracked as CVE-2026-45321 . Installing one of those versi...

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added three security flaws impacting the Linux kernel to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2025-39682 (CVSS score: 9.8) - An improper check for unusual or exceptional conditions vulnerability in the TLS receive path that could allow local authenticated users to trigger memory disclosure or denial-of-service (DoS). CVE-2026-53266 (CVSS score: 8.8) - An out-of-bounds write vulnerability in the ebtables Source Network Address Translation (SNAT) Address Resolution Protocol (ARP) rewrite path that could allow a local attacker to trigger unintended system behavior, DoS, or local privilege escalation. CVE-2025-39964 (CVSS score: 7.8) - A race condition vulnerability that could allow concurrent writes to the same AF_ALG socket, allowing a local attacker to crash the system or corrupt cryptographic op...

A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of access on a machine. Kernel maintainers have fixed all four over the past few weeks, so a system running an up-to-date kernel is not affected. But the exploit code is now public, and any machine still running an older kernel should be updated. The flaws are called DirtyAH6 , TUNderflow , PPPoEject , and DiagSpill . Researcher Asim Manizada found them and reported them to the Linux kernel security team in mid-July. He published a technical  write-up  with working exploits on September 18, after a coordinated hold with Linux distributions so the fixes could be released first. So far, there are no reports of the four being used in real-world attacks. The exploits are Manizada's own, are tuned to specific kernel builds, and can crash a machine, so they are meant for isolated test systems. Still, public exploit code raises the ris...

WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai , whose researchers reported the flaw, calls the attack chain Click2Shell . On its own the flaw only installs a real theme that the attacker picks, but the security research team showed it could be combined with a separate weakness in a theme to run the attacker's own code on the server.  The fix shipped on September 17 in WordPress 7.1.1 . Because this is a security release, WordPress advises updating right away. There is no sign the flaw has been used in real attacks. The installed theme stays switched off, so the site's own appearance does not change and nothing looks wrong. Reaching code execution needed a second, separate flaw in the theme that was installed. As pwn.ai wrote of t...

The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a fresh set of cyber attacks targeting government and defense entities in India and Afghanistan. The attacks, per Zscaler ThreatLabz, involve the use of previously undocumented tools called RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The activity has been codenamed Operation RapidRust . "APT36 has maintained a high operational tempo and updated their tactics, techniques, and procedures (TTPs) in continued attacks targeting government and defense organizations in India and Afghanistan," Sudeep Singh , senior manager of APT Research at Zscaler ThreatLabz, said in a technical report published this week. The discovery comes a little over a month after  Acronis Threat Research Unit (TRU) tied the long-running persistent threat group to another campaign aimed at Afghan telecom providers and South Asian critical infrastructure organizations using a backdo...

Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No customer action is required. The vulnerability, tracked as CVE-2026-85889 , carries a CVSS score of 10.0. "Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network," Microsoft said in a Thursday advisory. Azure AI Foundry, also called Microsoft Foundry, is an enterprise platform designed to build, deploy, and manage generative artificial intelligence (AI) applications and agents. The Windows maker credited security researcher Rémy Marot (@R_Marot) for discovering and reporting the flaw. There is no evidence that the issue has been exploited in the wild. Also patched by Microsoft in recent days are a number of other critical flaws -

In July 2025, someone registered a domain that used to belong to a content delivery network.  The CDN had been wound down years earlier, and the domain it served assets from was allowed to expire. What it had not lost were its callers. Thousands of websites, code repositories, and documentation pages still carry hard-coded references to hostnames beneath it.  The new owner holds wildcard DNS across the entire domain, and any hostname under it now resolves to infrastructure that person controls. Today the apex serves an ad-heavy media downloader page, which is unremarkable. The remarkable part is that the decision about what those thousands of pages load next belongs to a stranger, and nobody involved has been notified, because from the outside nothing broke.  This pattern is not hypothetical, and it's not unheard of either. In June 2024, the polyfill.io domain (a JavaScript shim embedded in more than 110,000 sites) changed ownership and began serving conditional redi...

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm  Air Security said on Thursday . The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no fix, and that Google will not patch the Gemini CLI, which it is retiring. The agents install add-ons called plugins from online marketplaces. To stay safe, a marketplace locks each plugin to a single reviewed version by its commit hash, a long string that identifies an exact snapshot of the code. Air found that the agents fetch that snapshot but never check that the code they end up with actually matches it. A branch is a named line of code in a repository. On a code host that lets someone create a branch whose name is made to look like the commit hash, the owner of a plugin's reposit...