The Hacker News

🚨 New NetamLoader malware targets a government-only Windows 10 build in Asia. The attack abuses legitimate Patch My PC components, hijacks .NET execution, bypasses AMSI, and loads encrypted payloads. Kaspersky identified one victim. The attackers remain unknown. How the attack works - https://thehackernews.com/2026/11/netamloader-malware-targets-government.html

‼️ FBI confirms North Korea's TraderTraitor hackers were behind the record $6.43 billion Binance crypto heist. $2.85 billion in stolen assets has been frozen as investigators track the laundering of funds through Ethereum. Full story: https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html

🚨 Blockchain analysis firm Chainalysis confirms a data breach involving offensive agentic techniques. An attacker gained access to internal systems and tools, exposing customer names, email addresses, user IDs, and organization roles. Full story: https://thehackernews.com/2026/10/chainalysis-confirms-intrusion-into.html

🚨 OpenAI fixed a ChatGPT flaw that allowed malicious shared links to execute attacker code in users' logged-in sessions and steal private chat content. Researchers demonstrated the attack. Here's how → https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html

🚨 8,226 DDoS attacks every hour. Cloudflare blocked 18.2 million network-layer DDoS attacks in Q3 2026, up 38% from Q2. Short-burst attacks surged 208%, while DNS amplification jumped 215%. Who's being targeted ↓ https://thehackernews.com/2026/10/cloudflare-reports-182-million-network.html

🚨 Chinese state-sponsored hackers used AI-powered ARTEX to target over 200 organizations worldwide. CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware. AI agents ran parallel attack paths under human direction. Full story: https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html

‼️ New TeamViewer vulnerability (CVE-2026-111585) flips the script... the machine you connect to can attack YOUR computer. No click needed beyond accepting the session. Researcher got code running on a stock Windows viewer — default settings, defenses on. Here's how the attack works ↓ https://thehackernews.com/2026/10/teamviewer-flaw-lets-remote-computers.html

🚨 Nearly 63,000 attack attempts target a WordPress RCE flaw in just 24 hours. Attackers are repeatedly probing upgrade paths, trying to catch a brief window during core updates that could allow unauthenticated code execution. Details ↓ https://thehackernews.com/2026/10/wordpress-rce-flaw-draws-nearly-63000.html

No Mythos access? You can now hunt for first and third-party exploitable vulnerabilities in your applications using Chainguard Harness. Chainguard Harness builds your app from source in an isolated environment, then lets Mythos 5.1 hunt through a live instance for exploitable vulnerabilities. Each finding is reproducible, delivered with a recommended fix, and vetted by a Chainguard engineer. Join the Chainguard Harness waitlist: https://thn.news/cve-malware-solution

‼️ WARNING - A Trezor Safe 5 wallet reportedly contained a hidden cellular implant designed to transmit users' recovery phrases. Trezor is now urging everyone who bought a wallet supplied by CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase. Details: https://thehackernews.com/2026/10/trezor-warns-of-suspected-hardware.html

🚨 703.56 million attacks blocked in one month after security remediation. Check Point reports a 99.5% remediation success rate across measured environments, with 21 million attacks blocked within 24 hours of remediation. How validated security changes delivered these results ↓ https://thehackernews.com/2026/10/why-urgent-security-fixes-arent-fixed.html

‼️ A Syrian hacker behind the 2013 AP Twitter hijack that triggered a temporary $136 billion stock market drop has been sentenced to 42 months in prison. The Syrian Electronic Army operative also hacked about 47 organizations, including media outlets and government targets. Full story ➜ https://thehackernews.com/2026/10/syrian-hacker-behind-fake-tweet-that.html

🚨 Official Claude Code VS Code extension compromised in a supply chain attack. Attackers injected a malicious loader into v2.1.313 to install a persistent SSH backdoor, add their SSH key, and send host data. Up to 5,000 users installed the malicious version. Read: https://thehackernews.com/2026/10/official-claude-code-vs-code-extension.html

🚨 Hackers are actively exploiting a highly critical flaw in Drupal Commerce Core. CVE-2026-118539 allows attackers to bypass access controls, potentially causing financial losses for vendors. Drupal confirms in-the-wild exploitation but has not disclosed the attack details or scale. Read more: https://thehackernews.com/2026/10/hackers-actively-exploit-highly.html

🚨 CISA adds two actively exploited Cisco and GitLab flaws to its KEV catalog. • GitLab: CVSS 10.0 RCE flaw targeted in an attempted attack on Alpine Linux • Cisco: Firewall flaw can trigger device reloads and DoS Federal agencies must patch by November 1. Details ↓ https://thehackernews.com/2026/10/cisa-adds-actively-exploited-gitlab-rce.html

🚨 BREAKING: Binance suffers a security breach affecting $6.3 billion in assets, with nearly $3 billion frozen on-chain. Attackers submitted unauthorized withdrawals, with a compromised DevOps engineer's laptop suspected as the entry point. Details ↓ https://thehackernews.com/2026/10/binance-suffers-security-breach.html

⚡ AI-powered attacks are moving faster. Is your security team ready? More alerts ≠ better security. Join our expert webinar to learn how to: → Spot real attack paths → Cut through security noise → Detect and respond faster Build practical AI threat readiness. Register FREE ⬇ https://thehackernews.com/2026/08/learn-how-to-build-security-operations.html

>> 40,000+ secrets exposed. >> 42 GitHub repos hijacked. >> AI bots hunting credentials. >> Token theft without extra permissions. >> 68GB of government data stolen. And that's just the start. This week's #ThreatsDay Bulletin covers 30 new cybersecurity stories worth your attention. Full roundup - https://thehackernews.com/2026/10/threatsday-critical-firewall-flaws.html

AI agents are taking on the work that once defined SOC analysts: alert triage, threat hunting, investigations, and response. What's next for security teams? A new role is emerging: the Threat Operator, directing AI-driven defense while humans retain control of critical decisions. Here's how the SOC is changing ↓ https://thehackernews.com/2026/10/the-rise-of-threat-operator-how-ai-will.html

‼️ Linux kernel TCP flaw rated 9.8 CVSS. Anthropic demonstrated an exploit that runs commands as root on servers using MPTCP. Ubuntu and RHEL still lack fixes, while Debian, Oracle and others have released patches for some versions. Details: https://thehackernews.com/2026/10/linux-kernel-tcp-flaw-with-98-cvss.html