‼️ Alert - Critical Brotli flaw behind #Node2Shell RCE goes far beyond Node.js.

Bun, Python Brotli packages, Envoy, Istio and other widely used software are also affected by the same CVE-2026-111497 memory-corruption vulnerability.

Read full details ↓ thehackernews.com/2026/10/brotli…

🚨 A malicious API could drain an AI agent's token balance via an x402 SDK flaw.

V12 rated 3 bugs critical:
— No default spending cap
— Solana approvals passed as payments
— Logins signed for other sites

All patched. No advisory, so npm audit & PyPI miss them.

Read more ↓ thehackernews.com/2026/10/critic…

🛑 ALERT - Node2Shell RCE exploit works on an official Node.js build.

Researchers demonstrated how crafted Brotli data can trigger code execution through vulnerable Node.js applications, without modifying the runtime.

Here's how the exploit works: thehackernews.com/2026/10/resear…

‼️ PHP2Shell exploit attempts hit millions as attackers try to deploy Mirai malware. Exposed attacker servers reveal RCE tooling.

No successful compromises confirmed so far.

Inside the payloads, exploit tools, and failed attempts → thehackernews.com/2026/10/php2sh…

‼️ Critical VeloCloud SQL injection flaw exploited in the wild.

Tracked as CVE-2026-114625 (CVSS 9.9), the flaw lets even read-only users escalate to full operator privileges.

Arista confirms active attacks.

What admins need to know ↓ thehackernews.com/2026/10/arista…

‼️ A single HTTP/3 connection can crash vulnerable web servers. No login required.

Newly disclosed QPACK flaws trigger up to 4,000× memory amplification in tests, exhausting server resources.

→ PoC is public
→ 7 implementations affected
→ Still unpatched: Bun, aioquic, h3
/t.co/yrYe2VeJVm

🚨 Node.js patches 10 security flaws, including a high-severity Brotli decoder bug that could allow RCE when apps decompress attacker-controlled data.

Patches are out for versions 22.x, 24.x, and 26.x.

Update Now ↓ thehackernews.com/2026/10/nodejs…

🚨 eMudhra is exiting the global SSL/TLS certificate business.

The decision comes just 5 days after a researcher exposed 8 easily guessable CA private keys.

Chrome and Firefox are withdrawing trust in its ECC root, leaving roughly 30,000 certificates needing replacement.
tps://t.co/WU1gC1iiFi

‼️ 3.2M secrets exposed. Source code stolen. Critical server takeover flaws. A bug that could keep your mic live after hang-up.

And that's still not the full picture.

This week's #ThreatsDay goes beyond the major headlines, covering 25 security stories, including serious ssed.

Read the full roundup:
thehackernews.com/2026/10/threat…

4,500+ accounts compromised. Nearly S$1M lost to Android malware scams. 600+ ransomware victims.

Also this week: hardware MFA downgrade phishing, NFC banking fraud, and active exploitation of old bugs.

A call that may not end when you hang up.

An AI connector tricked into accessing private repository secrets.

A developer tool exposed to remote code execution during authentication.

Three unusual security risks. Plenty more...

Read all 25 stories:
thehackernews.com/2026/10/threat…

‼️ALERT - Two new unpatched CVSS 9.0 RCE flaws in #Linux's KSMBD SMB server were disclosed on public kernel mailing lists before fixes were ready.

One can be triggered WITHOUT authentication.

Neither has a mainline kernel fix.

Details here ↓ thehackernews.com/2026/10/two-cv…

‼️ Meta ordered to pay $25 BILLION.

A New Mexico court found more than 43 million violations tied to Facebook's misleading data privacy promises.

The ruling stems from a lawsuit linked to the Cambridge Analytica scandal.

Full story ↓ thehackernews.com/2026/10/meta-o…

🔥 Your biggest AI insider threat may already be on an employee's laptop.

AI agents can access API keys, passwords, and internal systems without proper oversight.

Join Bitdefender's webinar to learn how to detect and govern shadow AI.

Save your seat → thehackernews.com/2026/10/the-ai…

⚡ INTERPOL arrests 1,462 suspects and disrupts 10,909 malicious networks in a major cybercrime crackdown.

21 countries. Over $105 million recovered. More than $385 million in losses linked to criminal activity.

Inside Operation Serengeti III ↓ thehackernews.com/2026/10/interp…

🛑 Railway reports a security incident involving systems storing customer environment variables.

An unauthorized party may have accessed encrypted secrets and, in some cases, decrypted contents.

Railway has invalidated API tokens and urges users to rotate credentials.

Details 3q

According to IBM’s recent Cost of a Data Breach Report, 43% of breached organizations reported a shadow AI incident in 2026, up from 20% the year before.

With shadow AI spreading faster than anyone can track, it’s easy to miss when an employee builds an agent with too-broad or a developer’s coding tool leaks production secrets.

With @NordLayer AI Scout, take control of your network: discover every AI tool in use, see what was asked, by whom, and where.

See what’s running in the gaps of your approved AI list 👉 thn.news/shadow-ai-tools

🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.

Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.

What developers need to know: thehackernews.com/2026/10/openco…

⚠️ LiteLLM’s release pipeline was hijacked.

Malicious v1.107.0 packages shipped a credential stealer and backdoor. Attackers later tested stolen AWS credentials.

LiteLLM suspects GitHub OAuth tokens were taken from logs on its exposed internal deployment.

Read ↓ thehackernews.com/2026/10/litell…