The Hacker NewsOct 21, 2026AI Penetration Testing / Web Security An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes…
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last hop…
Unknown threat actors breached TeamUpdraft’s website and potentially gained unauthorized access to customers’ connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress…
Swati KhandelwalOct 21, 2026Artificial Intelligence / National Security U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services “developed using DeepSeek implementations,” under a Department…
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came from.…
Ravie LakshmananOct 21, 2026Vulnerability / Malware The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting Plex Media Server that’s collectively…
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity has been attributed to a threat cluster…
Swati KhandelwalOct 21, 2026Vulnerability / Web Security PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0…
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google’s Chrome Root Program confirms on October 20. An intermediate CA signs the certificates that websites present, so anyone holding one of these keys…
Ravie LakshmananOct 20, 2026Vulnerability / Enterprise Security Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The vulnerability, tracked…