‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js.

Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability.

Read full details ↓ thehackernews.com/2026/10/brotli…

🚨 LiteLLM reveals the root cause of its supply chain attack.

A master key leaked on GitHub in May was never revoked, allowing attackers to access its Agent Platform, steal a GitHub owner token, and publish a malicious PyPI release in October.

Read: thehackernews.com/2026/10/leaked…

Google says your Gmail, Drive, and Photos data could influence the ads you see.

The catch? This can happen when you opt to share that data with AI-powered Search features.

Google's updated privacy policy spells out the trade-off.

Here's what you need to know: thehackernews.com/2026/10/google…

🚨 Researchers pushed over 2 million remote updates to disable a forgotten Popcorn Time updater that could have fueled a botnet.

The flaw let anyone controlling its update domain deliver code with SYSTEM or root privileges.

How they pulled it off ↓ thehackernews.com/2026/10/resear…

🚨 Two critical flaws. Both actively exploited.

CISA confirms attacks targeting Collabora Online and Arista VeloCloud.

• Collabora flaw exploited to plant web shells on Nextcloud servers
• Third exploited VeloCloud flaw since July
Federal patch deadline: October 26.

Read E2PAO8p

🚨 UPDATE: Railway says hackers targeted AI API keys to carry out model distillation attacks.

Up to 100,000 workspaces may have been exposed.

Attackers allegedly used uncensored AI models and massive compute resources to breach its infrastructure.

What we know: thehackernews.com/2026/10/railwa…

‼️ Patched, but still exploitable.

The new BlackX UEFI bootkit bypasses Secure Boot on Windows systems missing required revocations, even after the patch is installed.

Attackers used it in breaches of Central Asian diplomatic networks after gaining admin access.

Details: thehackernews.com/2026/10/blackx…

‼️ FOUR critical GitLab RCE flaws traced back to just THREE bugs in Ruby's regex engine.

Ruby has now fixed them, but this isn't just a GitLab issue.

Other Ruby apps that compile attacker-controlled regex patterns are also affected.

Details ➜ thehackernews.com/2026/10/ruby-f…

🚨 Exposed infrastructure reveals how ransomware affiliates used AI to hack networks and steal data.

8,257 messages. 133 AI sessions. 62 organizations targeted.

Operators exploited Fortinet, SimpleHelp, and cPanel flaws.

Inside the operation ↓ thehackernews.com/2026/10/expose…

‼️ PHP2Shell exploit attempts hit millions as attackers try to deploy Mirai malware. Exposed attacker servers reveal RCE tooling.

No successful compromises confirmed so far.

Inside the payloads, exploit tools, and failed attempts → thehackernews.com/2026/10/php2sh…

🛑 ALERT - Node2Shell RCE exploit works on an official Node.js build.

Researchers demonstrated how crafted Brotli data can trigger code execution through vulnerable Node.js applications, without modifying the runtime.

Here's how the exploit works: thehackernews.com/2026/10/resear…

🚨 Hackers breached enterprise firewalls and VPNs worldwide in a campaign linked to k0t.

Over 70,000 exposed credentials identified.

Fortinet and Palo Alto devices targeted. Persistent access established. Data exfiltrated.

Inside the attack chain and suspected ransomware 6zQ4ZTj

Former-employee data with no end date is still in scope for breaches, legal requests, and audits.

Live demo: defensible deletion in Google Workspace, from approval to Vault export to verified deletion.

Free · Oct 29 · 2 pm ET → thn.news/cost-saving-we…

‼️ BREAKING ‼️ PHP warns of another UNPATCHED REC vulnerability just 2 days after releasing emergency patches for critical PHP2Shell flaws.

New "CVE-2026-115560" affects only unusual session configurations. PHP has issued urgent mitigation guidance.

Full details → thehackernews.com/2026/10/urgent…

PHP has a one-line mitigation for CVE-2026-115560:

session.upload_progress.enabled=0

This disables session upload progress until the fix arrives in a routine release.

Already applied this mitigation for CVE-2026-109619? No further action is needed.

Why isn't PHP issuing another emergency patch?

The project considers CVE-2026-115560 unlikely to affect real-world configurations.

• No severity score announced
• No affected version list yet
• Fix planned for a routine release

thehackernews.com/2026/10/urgent…

🚨 Russian state-sponsored Sandworm wiped a Ukrainian logistics firm after UAC-0099 handed over access.

The intrusion involved a new backdoor, MythicRatatoskr, controlled through the Yggdrasil mesh network.

Inside the two-group operation ↓ thehackernews.com/2026/10/russia…

🛑 A filename is enough to trigger OS command execution in Python's widely used Pillow image library.

CVE-2026-112900 abuses how Pillow passes EPS filenames to Ghostscript.

What you need to know ↓ thehackernews.com/2026/10/critic…