The Hacker News | #1 Trusted Source for Cybersecurity News — Index Page

A flaw in SAP's  Cloud SDK for Python  can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a  security advisory  on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain, the name such an application passes to the SDK to say which tenant a request is for. The flaw is tracked as CVE-2026-89111 and carries SAP's CVSS score of 10.0 out of 10. The advisory names  version 0.45.2 , released on August 21, as the fix. The SDK handles authentication for those services with the application's client credentials, a client ID and a client secret. Version 0.45.2 added a check that rejects any tenant subdomain that is not a simple name. Six later releases do not apply that check in every case, The Hacker News found. Versions 0.53.0 through 0.55.0, published betwe...

GitHub has taken the step of expiring unvalidated npm trusted publishing configurations 48 hours after creation after researchers found that it was possible for an attacker to push new versions of a different user's package without having to steal their credentials. "Your configuration becomes validated and exempt from expiry after its first successful publish," the Microsoft-owned subsidiary said . "Changing the repository or project identity requires a new trust relationship with a fresh 48-hour validation window -- ordinary edits don't restart the deadline." The change contains the risk associated with trusting a repository or project name that changes ownership, GitHub said, adding npm also rejects trusted publishing tokens from GitHub Actions issue_comment events going forward, along with the existing pull_request_target restriction. In an update to its documentation, GitHub states that a newly created trusted publisher configuration must compl...

The Norwegian Data Protection Authority (DPA) has fined Xandr, an advertising unit owned by Microsoft, €8.6 million ($9.62 million) for illegally relaying ​Grindr users' sensitive data to advertisers. The administrative penalty is the largest issued by the data protection watchdog, arguing the case merited a high fine because of the "very serious" nature of the breach. The infringements occurred between July 2018 and April 2020. "Xandr acted as an intermediary that relayed the personal data of Grindr users in Norway, including data revealing sexual orientation, to potentially thousands of other companies," the Data Protection Authority said in a statement. The data protection authority said its investigation found that Xandr was a joint controller with Grindr, which meant it was responsible for obtaining users' consent before processing their data. Instead of ensuring they had the legal basis for their own processing of the data, Xandr pointed fing...

The dangerous part of a stolen identity isn't always the initial login. It's what an attacker can do with that access next. With AI accelerating reconnaissance, exploitation of vulnerabilities, and privilege escalation, attackers can move through systems faster than security teams can investigate. A compromised account that looks legitimate at first could become the starting point for a much larger attack. And that's where traditional identity security faces a serious problem: Checking who gets access isn't enough if you can't control what happens after. See How to Stop AI-Powered Identity Attacks — Register for the Webinar Why Traditional Identity Controls Are Falling Behind

Three vulnerabilities in LG's webOS can be chained to give an attacker on the same local network root access to certain smart TVs without a PIN or any interaction from the owner. LG has issued a fix, according to an advisory published by SSD Secure Disclosure on October 12. The chain was tested on two TV models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware versions are affected is not known. Owners of affected TVs should check for a firmware update. No workaround is available for those who cannot update yet. The attack enters through a service that the TV exposes on port 3001, which is used by the LG ThinQ app for pairing. An attacker replays a manifest from sync-demo, a built-in app already on the device, signed with a test certificate the firmware trusts. A permission in the manifest causes the pairing service to skip the PIN prompt and hand over a privileged key. With that key, the attacker laun...

A user opens a browser tab, pastes data into a chat assistant, and nothing is installed. A developer adds a coding assistant as an editor extension, and nothing shows up in the installed programs list. Someone downloads a local model runtime, a program that runs models directly on the machine instead of sending data to an external service, because they were told not to send company data outside. None of this reaches your software inventory. Tasked with controlling AI, an administrator often resorts to blocking well-known AI websites and taking enforcement action without knowing what is actually running. Bitdefender GravityZone AI Visibility and Control (AIVC) is the discovery and risk layer that answers the questions you have, first: Which AI software is present on your protected Windows endpoints, who is running it, and how much risk does each one carry. What Your Software Inventory Was Never Built to Watch AI Visibility and Control covers four classes of exposu...

Attackers took remote control of fridges and freezers at hundreds of French supermarkets on the night of October 11 and warmed them, forcing stores to throw food away, several retail chains said. The attackers reached them through the controller that runs all of a store's fridges and freezers, a device made by Danish company Danfoss that maintenance firms can manage remotely. Les Mousquetaires, which owns the Intermarché chain, said its fridges and freezers were put into defrost and heated to as much as 50°C. CERT-FR, the French government's computer emergency response team, said in an  alert published in French  on October 12 that it is aware of numerous compromises affecting two Danfoss controller series, the AK-SM and the AK-SC. It told operators to disconnect the controllers or filter access to them. CERT-FR is part of ANSSI, France's national cybersecurity agency. ANSSI's head, Vincent Strubel, called it urgent to take the two series off the internet or fil...

Two of 31 newly disclosed flaws in Progress Software's  MarkLogic Server  database could let an account given only some management privileges take administrator control of the server, the company says. Progress published all 31 on October 12 and scored five of them critical. Fixes have been available since September 10, in  MarkLogic 11.3.7  and  MarkLogic 12.1.0 . Affected releases, and the release that fixes each: MarkLogic 11.x before 11.3.7: upgrade to 11.3.7 MarkLogic 12.x before 12.1.0: upgrade to 12.1.0 MarkLogic 11.3 is the long-term support (LTS) line. The 12 line, which Progress calls an innovation release, has no patched 12.0 release. Its fix is 12.1.0, which also adds new features. Installing the fixes for the 10 MarkLogic flaws Progress disclosed in August is not enough. Those fixes arrived in 11.3.6 and 12.0.3, and both releases are affected by the new flaws. Progress's CVE records and its upgrade notes for the two releases do n...

GitLab has released patches for a maximum-severity security flaw impacting its Community Edition (CE) and Enterprise Edition (EE) software that could result in arbitrary code execution. "GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation," the company said in a Monday advisory. The flaw, tracked as CVE-2026-97229 , has been described as an integer overflow issue. It carries a CVSS score of 10.0. It affects the following versions - All versions from 19.2 before 19.2.8 All versions from 19.3 before 19.3.5, and All versions from 19.4 before 19.4.2 Patches for the flaw are available in versions 19.4.2, 19.3.5, and 19.2.8. Also addressed are three high-severity bugs - CVE-2026-92883 (CVSS score: 8.7) - A cross-site scripting vulnerability...