Veille : The Hacker News
Les publications récentes de The Hacker News.
Mis à jour le 22 octobre 2026 à 17:06 · 50 liens sur 30 jours
INTERPOL Arrests 1,462 Suspects, Disrupts 10,909 Cybercrime Networks in Global Crackdown (nouvel onglet)
INTERPOL on Thursday announced that a coordinated law enforcement action has disrupted 10,909 malicious networks and recovered more than $105 million in illicit funds. In tandem, the effort saw law…
The AI Agent Nobody Owns: Watch Expert Webinar On Your Newest Insider Threat (nouvel onglet)
Right now, there is probably an AI agent running on a laptop somewhere in your network. It stores API keys and database passwords, can access your internal systems, and works without anyone watching…
Railway Says Intruder May Have Accessed Customer Secrets, Urges Credential Rotation (nouvel onglet)
Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables. Upon further investigation, the company found…
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL (nouvel onglet)
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model…
LiteLLM Suspects GitHub Token Leak in AI Gateway Logs Behind Malicious Package Release (nouvel onglet)
LiteLLM on Wednesday disclosed that threat actors compromised "multiple independent security controls" to push a malicious version of the Python package containing a credential stealer and a…
Node.js Brotli Decoder Bug Could Allow Remote Code Execution in All Supported Versions (nouvel onglet)
Node.js released security updates on October 21 for its three supported release lines, 22.x, 24.x and 26.x, fixing 10 flaws. The most serious is a bug in the Brotli decompression code that Node.js…
New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification (nouvel onglet)
A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of…
Someone Tried to Exploit PHP2Shell 4 Days Before the Vulnerabilities Were Publicly Disclosed (nouvel onglet)
Amazon's Threat Intelligence team on Wednesday said it detected an attempt to exploit the newly disclosed PHP2Shell vulnerabilities on October 17, 2026, against its MadPot honeypot service, as the…
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack (nouvel onglet)
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident…
Critical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of Releases (nouvel onglet)
GitLab released fixes on October 21 for a flaw that lets an attacker run code on a self-managed server without logging in, and it affects every version of the software going back to 7.0, released in…
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor (nouvel onglet)
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket…
OpenAI's GPT-6 Agent Removed Safety Monitoring, Then Falsely Denied Doing So (nouvel onglet)
OpenAI has revealed that two artificial intelligence (AI) agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring while making requested software changes during two internal…
PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge (nouvel onglet)
PHP has released emergency updates that fix two critical flaws in the language itself, letting an attacker without an account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and…
Google Chrome Adds ClickFix Warnings to Stop Users From Running Malicious Commands (nouvel onglet)
Google on Tuesday said it's rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular social…
China-Aligned Bronze Sandcastle Abuses Sandboxie DLL Sideloading to Deploy Backdoors (nouvel onglet)
Cybersecurity researchers have disclosed details of a previously undocumented China-aligned threat cluster known as Bronze Sandcastle that has been observed targeting organizations in Asia and Africa…
Generative AI Is Erasing Behavioral Tells, Weakening Behavior-Only Detection, Proofpoint Reports (nouvel onglet)
Generative AI has changed what a malicious email looks like. Messages that once gave themselves away through clumsy wording, generic pretexts, and reused templates now arrive fluent, personalized…
PHP2Shell: What Actually Protects You Before the 14:00 UTC PHP RCE Patch, and What Doesn't (nouvel onglet)
You cannot fully block the two critical PHP flaws called PHP2Shell before today's fix, and the one setting being passed around as a workaround is not enough on its own, the security firm that…
The Harness Is the Hard Part of Agentic Pentesting (nouvel onglet)
An AppSec team can point an AI agent running on a general-purpose model at its own web apps with little setup. Sure, the model writes the attacks. But everything that makes those attacks safe to run…
Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections (nouvel onglet)
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found. Exit relays are the last…
PHP2Shell: Two Unpatched Critical PHP RCE Flaws (CVSS 9.2) Trigger Emergency Security Alert (nouvel onglet)
This story is developing and was written before PHP's scheduled 14:00 UTC release on October 21. Once the release is out, the affected and fixed versions below are confirmed by the official advisory…
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites (nouvel onglet)
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to…
U.S. Orders DeepSeek Removed From Federal Civilian Systems, Bans New Purchases (nouvel onglet)
U.S. federal civilian agencies must remove DeepSeek products from their information technology systems, along with any third-party products or services "developed using DeepSeek implementations,"…
State Bank of India Confirms Data Leak After 3,897 Customer Records Found on Dark Web (nouvel onglet)
State Bank of India has identified 3,897 customer records containing personal information in a set of about 375,000 records available on the dark web, and it does not yet know where the data came…
CISA Orders Federal Agencies to Patch Exploited Plex2Shell, Siemens, and SiteGuard Flaws (nouvel onglet)
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including four vulnerabilities impacting…
Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion (nouvel onglet)
A Belarus-aligned hacktivist group spent nearly two years within the network of a Russian healthcare organization. According to a report published by Russian cybersecurity firm Solar, the activity…
Eight eMudhra CA Keys Compromised, Triggering Emergency Fixes Across Browsers and Software (nouvel onglet)
The private keys of eight eMudhra intermediate certificate authority (CA) certificates are compromised, Mozilla and Google's Chrome Root Program confirms on October 20. An intermediate CA signs the…
Critical FortiSIEM Flaw Gets Public Exploit PoC for Unauthenticated Remote Code Execution (nouvel onglet)
Cybersecurity researchers have released a proof-of-concept (PoC) exploit for a recently patched critical security flaw impacting Fortinet FortiSIEM that could result in arbitrary code execution. The…
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA (nouvel onglet)
Palo Alto Networks has disclosed that it's continuing to observe exploitation of a now-patched security flaw impacting PAN-OS and Prisma Access by ransomware actors. The activity relates to…
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites (nouvel onglet)
A Chinese-speaking criminal pointed autonomous AI agents at company websites and let them break in with almost no help, and a security researcher watched it happen because the operators left their…
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election (nouvel onglet)
The iPhone of Vladan Đokić, rector of the University of Belgrade and a prominent supporter of Serbia's student protest movement, was infected with NSO Group's Pegasus spyware in 2026, the Citizen Lab…
WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators (nouvel onglet)
WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts…
What Security Teams Can Do To Tame Wild Code (nouvel onglet)
A sales manager builds an AI-assisted workflow to route leads. It connects to customer records, summarizes inbound requests, and posts updates to a shared channel. The workflow saves time, reduces…
Go Issues Emergency Update Blocking Eight CA Keys Over Undisclosed Security Concerns (nouvel onglet)
Go 1.27.3 and Go 1.26.10, released on October 20, make Go's certificate verifier reject any certificate chain that passes through one of eight intermediate certificate authority keys. Programs built…
Russian APT28 Breaches NATO Naval Shipbuilder in NATO Country, Deploys New Reflective Loader (nouvel onglet)
The Russia-linked state-sponsored threat actor tracked as APT28 (aka BlueDelta, Fancy Bear, and Forest Blizzard) has been attributed to attacks targeting two member states of the North Atlantic…
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident (nouvel onglet)
ConnectWise on Monday said it has taken remediation measures, including strengthening administrative-access protections and resetting accounts and replacing application credentials, as it continues…
Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware (nouvel onglet)
An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and…
ClickFix Attackers Exploit Siemens Software Center Flaw to Deploy Remote Access Trojan (nouvel onglet)
Siemens has addressed a DLL sideloading vulnerability impacting Siemens Software Center that it said has been exploited in ClickFix attacks. The high-severity vulnerability, tracked as…
Ex-OpenAI Engineer Detained in Spy Device Case as Saudi Royal Contacts Emerge (nouvel onglet)
A U.S. court on Monday granted the U.S. government's request to detain a former OpenAI engineer accused of planting a recording device in an executive conference room at the company's San Francisco…
Hackers Use New ROMULUS ClickFix Platform to Deliver LegionLoader and Other Malware (nouvel onglet)
Cybersecurity researchers have disclosed details of a ClickFix delivery platform called ROMULUS that's being used to distribute malware such as Legion Loader. According to Forescout Research - Vedere…
Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor (nouvel onglet)
Threat actors have begun to exploit a chain of vulnerabilities in Plex Media Server to deploy cryptocurrency miners and reverse proxy software, a day after a proof-of-concept (PoC) went public…
Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor (nouvel onglet)
Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on…
⚡ Weekly Recap: 98 Zero-Days, Rogue AI Agents, $100M Crypto Theft, 700 Supermarkets Hit and More (nouvel onglet)
The worst problems don't always come with a warning. Sometimes they arrive through a service everyone trusts, a device someone bought, or a system nobody thought to check. By the time something looks…
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories (nouvel onglet)
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a…
From Email-to-Case to the Boardroom: How Inherited Agents Break Governance Built for Software (nouvel onglet)
In Salesforce Agentforce, the recommended way to make an agent respond to events is a Flow: a record is created or a case is updated, and the Flow passes data into the agent's prompt. Separately…
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic (nouvel onglet)
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial…
Unpatched Broadcom Wi-Fi Flaw Lets Attackers in Range Run Code as Root on Routers (nouvel onglet)
A flaw in Broadcom's Wi-Fi setup software lets an attacker within radio range run code as root on Broadcom-based routers, without the network password or any pairing step, security researcher Quentin…
OpenCode Console Breach May Have Exposed OpenAI, Anthropic, and Google API Keys (nouvel onglet)
An intruder reached a legacy system at OpenCode on the night of October 16 and may have exposed the third-party AI provider keys that users had saved in OpenCode Console, the company said. Console is…
ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants (nouvel onglet)
ConnectWise on Saturday said it has disabled seven ConnectWise application identities as it continues its investigation into an incident in which unknown threat actors obtained unauthorized access to…
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon (nouvel onglet)
Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded…
Hackers Use Compromised ConnectWise Credential to Sign In to 173 Microsoft 365 Tenants (nouvel onglet)
Cybersecurity researchers are sounding the alarm related to an active campaign in which unknown threat actors are abusing a compromised Microsoft 365 (M365) credential belonging to ConnectWise Cloud…