The Hacker News (Security) Articles

Updated 3 min ago · 50 articles from The Hacker News (Security)

The Hacker News (Security) Oct 15, 4:01 PM

Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads

Candiru, an Israeli maker of spyware sold to governments, infected devices at the news network Al Jazeera through ordinary online ads, in attacks that needed...

The Hacker News (Security) Oct 15, 4:00 PM

Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks

The threat actor known as Silent Lynx has been attributed to a fresh set of attacks targeting government organizations across the Commonwealth of Independent...

The Hacker News (Security) Oct 15, 2:11 PM

Help TDS Linked to Hotejka as 20,000+ Cloudflare Pages Domains Host Tech Support Scams

A long-running Traffic Distribution System (TDS) known as Help TDS to a Russian-language affiliate program called Hotejka, which appears to be a rebrand of a...

The Hacker News (Security) Oct 15, 12:58 PM

NGINX Fixes 5 Flaws, Including Possible RCE and a TLS Bug That May Skip Client-Cert Checks

NGINX released versions 1.30.6 and 1.31.7 on October 14 to fix five vulnerabilities, one of them present in every release since May 2005. There are three mem...

The Hacker News (Security) Oct 15, 12:28 PM

Next.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing

Next.js released an out-of-band security update on October 14 that fixes two critical flaws allowing unauthenticated remote code execution, along with a high...

The Hacker News (Security) Oct 15, 12:07 PM

Drupal Patches Critical Field UI Flaw With Unauthenticated RCE Path via Contributed Modules

Drupal core has a critical flaw in its Field UI module that could let an attacker run code on the site's server, and fixes were shipped on October 14 in Drup...

Ad
The Hacker News (Security) Oct 15, 11:46 AM

Fake AI Attacks Spread Across US Companies: How MSSPs Can Stop Incidents Early

Attackers are impersonating popular AI products to distribute malware, steal browser sessions, and compromise business accounts. ANY.RUN linked 1,258 public ...

The Hacker News (Security) Oct 15, 11:46 AM

Palo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation

Palo Alto Networks on Wednesday issued security updates for a high-severity flaw in PAN-OS software that has come under active exploitation. The vulnerabilit...

The Hacker News (Security) Oct 15, 11:04 AM

Why AI Confidence Is Not Validation

AI is already part of digital forensics and incident response work, with or without a policy in place to govern it. The issue is that these tools are growing...

The Hacker News (Security) Oct 15, 10:42 AM

India Mandates Registered Caller Name Display on 4G and Newer Networks From November 1

The Indian government has directed telecom service providers (TSPs) in the country to mandatorily display callers' registered names along with their numbers ...

The Hacker News (Security) Oct 15, 8:45 AM

GhostAction Compromises About 1,900 GitHub Accounts, Targets Over 30,000 Repositories

The credential-theft campaign known as GhostAction has ramped up, targeting more than 30,000 repositories across 3,000 users and organizations. The spike, ac...

The Hacker News (Security) Oct 15, 7:07 AM

Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit Attempts

Threat actors are exploiting a critical security flaw in Langflow, according to an alert from Previdian. Langflow is an open-source platform that allows deve...