All News
The Hacker News
The Hacker News
January 10, 2026
MuddyWater Launches RustyWater RAT via Spear-Phishing Across Middle East Sectors
MuddyWater launched RustyWater, a Rust-based RAT, via spear-phishing Word macros targeting Middle East organizations.
The Hacker News
January 10, 2026
Europol Arrests 34 Black Axe Members in Spain Over €5.9M Fraud and Organized Crime
Europol says 34 Black Axe members were arrested in Spain, linked to €5.93 million in fraud and other organized crimes.
The Hacker News
January 9, 2026
Chinese-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual Machines
Researchers found Chinese-linked attackers abused SonicWall VPN access and VMware ESXi zero-day flaws to escape VMs and gain hypervisor cont...
The Hacker News
January 9, 2026
Russian APT28 Runs Credential-Stealing Campaign Targeting Energy and Policy Organizations
Russian-linked APT28 ran credential-harvesting attacks in 2025 using fake Microsoft, Google, and VPN login pages, PDF lures, and legitimate...
The Hacker News
January 9, 2026
Cybersecurity Predictions 2026: The Hype We Can Ignore (And the Risks We Can't)
Bitdefender webinar uses real-world research to identify which 2026 cybersecurity predictions matter, covering ransomware and AI risks.
The Hacker News
January 9, 2026
Trend Micro Apex Central RCE Flaw Scores 9.8 CVSS in On-Prem Windows Versions
Trend Micro patched a critical Apex Central on-prem Windows flaw (CVE-2025-69258) with CVSS 9.8 that allows remote code execution if access...
The Hacker News
January 9, 2026
CISA Retires 10 Emergency Cybersecurity Directives Issued Between 2019 and 2024
CISA has closed 10 emergency cybersecurity directives issued between 2019 and 2024 after required actions were completed and enforced under...
The Hacker News
January 9, 2026
FBI Warns North Korean Hackers Using Malicious QR Codes in Spear-Phishing
FBI warns Kimsuky hackers linked to North Korea are using malicious QR codes to bypass MFA, steal session tokens, and hijack cloud accounts.
The Hacker News
January 8, 2026
WhatsApp Worm Spreads Astaroth Banking Trojan Across Brazil via Contact Auto-Messaging
Astaroth banking malware is spreading in Brazil through WhatsApp messages, using ZIP files to steal contacts and banking credentials on Wind...
The Hacker News
January 8, 2026
China-Linked UAT-7290 Targets Telecoms with Linux Malware and ORB Nodes
Cisco Talos reports China-linked UAT-7290 spying on telecoms since 2022 using Linux malware, edge exploits, and ORB infrastructure for acces...
The Hacker News
January 8, 2026
ThreatsDay Bulletin: RustFS Flaw, Iranian Ops, WebUI RCE, Cloud Leaks, and 12 More Stories
Weekly cybersecurity roundup covering exploited vulnerabilities, malware campaigns, legal actions, and nation-state attacks across cloud, AI...
The Hacker News
January 8, 2026
The State of Trusted Open Source
Analysis shows most security risk sits in longtail open source images, with 98% of CVEs outside top projects & Critical flaws fixed in under...
The Hacker News
January 8, 2026
Cisco Patches ISE Security Vulnerability After Public PoC Exploit Release
Cisco released updates for a medium-severity ISE and Snort 3 flaws, including CVE-2026-20029 with a public PoC, and reports no exploitation...
The Hacker News
January 8, 2026
Researchers Uncover NodeCordRAT Hidden in npm Bitcoin-Themed Packages
Security researchers found 3 npm packages that installed NodeCordRAT malware, stealing browser data, crypto wallet secrets & tokens using Di...
The Hacker News
January 8, 2026
Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances
Coolify Discloses 11 Critical Flaws Enabling Full Server Compromise on Self-Hosted Instances | Read more hacking news on The Hacker News cyb...
The Hacker News
January 8, 2026
OpenAI Launches ChatGPT Health with Isolated, Encrypted Health Data Controls
OpenAI introduces ChatGPT Health, a separate, encrypted space for health chats with optional app data access, focused on privacy and support...
The Hacker News
January 8, 2026
CISA Flags Microsoft Office and HPE OneView Bugs as Actively Exploited
CISA adds two vulnerabilities affecting Microsoft Office and HPE OneView to its KEV list, urging agencies to patch by January 28, 2026.
The Hacker News
January 7, 2026
Webinar: Learn How AI-Powered Zero Trust Detects Attacks with No Files or Indicators
Fileless attacks abuse trusted tools, scripts, and CI/CD pipelines, creating blind spots that file-based security can’t detect.
The Hacker News
January 7, 2026
Critical n8n Vulnerability (CVSS 10.0) Allows Unauthenticated Attackers to Take Full Control
A critical CVSS 10.0 vulnerability in n8n allows unauthenticated attackers to read files, bypass authentication, and gain full server contro...
The Hacker News
January 7, 2026
n8n Warns of CVSS 10.0 RCE Vulnerability Affecting Self-Hosted and Cloud Versions
n8n disclosed CVE-2026-21877, a critical authenticated RCE flaw with CVSS 10.0, fixed in version 1.121.3 after affecting earlier releases.
The Hacker News
January 7, 2026
Veeam Patches Critical RCE Vulnerability with CVSS 9.0 in Backup & Replication
Veeam patched four Backup & Replication flaws, including CVE-2025-59470 (CVSS 9.0) enabling RCE; update to version 13.0.1.1071.
The Hacker News
January 7, 2026
Microsoft Warns Misconfigured Email Routing Can Enable Internal Domain Phishing
Attackers exploit misconfigured email routing and weak spoof protections to send internal-looking phishing emails for credential theft and s...
The Hacker News
January 6, 2026
Two Chrome Extensions Caught Stealing ChatGPT and DeepSeek Chats from 900,000 Users
Security researchers found two Chrome extensions with 900,000 installs secretly collecting ChatGPT and DeepSeek chats and browsing data.
The Hacker News
January 6, 2026
Fake Booking Emails Redirect Hotel Staff to Fake BSoD Pages Delivering DCRat
A new PHALT#BLYX campaign targets European hotels using fake Booking.com emails, ClickFix lures, PowerShell, and MSBuild to deploy DCRat mal...
The Hacker News
January 6, 2026
New n8n Vulnerability (9.9 CVSS) Lets Authenticated Users Execute System Commands
Critical n8n flaw CVE-2025-68668 allows authenticated users to run system commands via workflows; affects versions 1.0.0 to before 2.0.0, fi...
The Hacker News
January 5, 2026
Kimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy Networks
Kimwolf is an Android botnet that infected 2M+ devices via exposed ADB, using proxy networks to run DDoS attacks and sell residential bandwi...
The Hacker News
January 5, 2026
⚡ Weekly Recap: IoT Exploits, Wallet Breaches, Rogue Extensions, AI Abuse & More
First 2026 cyber recap covering IoT exploits, wallet breaches, malicious extensions, phishing, malware, and early AI abuse.
The Hacker News
January 5, 2026
The Security Platform Is Dead. Long Live the Security Platform
Why security platforms rise as tool sprawl hits 45 tools per enterprise, consolidation grows, and mid-market teams seek simpler, prevention-...
The Hacker News
January 5, 2026
New VVS Stealer Malware Targets Discord Accounts via Obfuscated Python Code
VVS Stealer is a Python-based malware sold on Telegram that steals Discord tokens, browser data, and credentials using heavy code obfuscatio...
The Hacker News
January 5, 2026
Deepfake Job Hires: When Your Next Breach Starts With an Interview
Deepfake-driven hiring fraud is rising, with fake employees gaining access, stealing data, and evading detection across organizations.
The Hacker News
January 2, 2026
Transparent Tribe Launches New RAT Attacks Against Indian Government and Academia
Transparent Tribe (APT36) is linked to new cyber-espionage attacks using malicious LNK files, adaptive RATs, and long-term persistence again...
The Hacker News
January 2, 2026
The ROI Problem in Attack Surface Management
Attack surface management ROI improves when ownership, exposure duration, and risky endpoints decline—not when asset counts rise.
The Hacker News
January 2, 2026
Cybercriminals Abuse Google Cloud Email Feature in Multi-Stage Phishing Campaign
Attackers misused Google Cloud Application Integration to send 9,394 phishing emails from Google domains, bypassing filters and stealing cre...
The Hacker News
January 1, 2026
ThreatsDay Bulletin: GhostAd Drain, macOS Attacks, Proxy Botnets, Cloud Exploits, and 12+ Stories
The first ThreatsDay Bulletin of 2026 tracks GhostAd adware, macOS malware, proxy botnets, cloud exploits, and more emerging cyber threats.
The Hacker News
January 1, 2026
RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers
RondoDox botnet exploits the React2Shell vulnerability in Next.js, with over 90,000 exposed systems used to deploy miners and malware worldw...
The Hacker News
January 1, 2026
How To Browse Faster and Get More Done Using Adapt Browser
Learn how a lightweight browser architecture can reduce overhead, improve performance, & help users browse faster while staying focused & pr...
The Hacker News
December 31, 2025
Trust Wallet Chrome Extension Hack Drains $8.5M via Shai-Hulud Supply Chain Attack
Trust Wallet confirmed a supply chain attack let hackers push a malicious Chrome extension update, draining $8.5 million from 2,520 wallets.
The Hacker News
December 31, 2025
DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide
A China-linked threat actor used malicious browser extensions over seven years to steal data and corporate intelligence from Chrome, Edge, a...
The Hacker News
December 31, 2025
Critical CVSS 9.8 Flaw Found in IBM API Connect Authentication System
IBM disclosed a critical CVSS 9.8 authentication bypass in IBM API Connect that could allow remote access; patches are now available.
The Hacker News
December 31, 2025
Researchers Spot Modified Shai-Hulud Worm Testing Payload on npm Registry
A new Shai-Hulud npm strain and a fake Jackson Maven package show how attackers abuse trusted dependencies to steal secrets and spread malwa...
The Hacker News
December 31, 2025
U.S. Treasury Lifts Sanctions on Three Individuals Linked to Intellexa and Predator Spyware
The U.S. Treasury has removed three individuals linked to Intellexa and Predator spyware from its sanctions list, without explaining the dec...
The Hacker News
December 30, 2025
CSA Issues Alert on Critical SmarterMail Bug Allowing Remote Code Execution
Singapore’s CSA warns of a CVSS 10.0 SmarterMail vulnerability allowing unauthenticated remote code execution via file upload; patch availab...
The Hacker News
December 30, 2025
Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware
Silver Fox is using India income tax phishing emails and fake software sites to install ValleyRAT, a modular Windows remote access trojan.
The Hacker News
December 30, 2025
How to Integrate AI into Modern SOC Workflows
The 2025 SANS SOC Survey shows AI use is rising, but many SOCs lack integration, customization, and clear validation processes.
The Hacker News
December 30, 2025
Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor
Mustang Panda deployed TONESHELL via a signed kernel-mode rootkit, targeting Asian government networks and evading security tools.
The Hacker News
December 29, 2025
⚡ Weekly Recap: MongoDB Attacks, Wallet Breaches, Android Spyware, Insider Crime & More
Weekly 2025 cyber recap: MongoBleed targets 87,000, Trust Wallet $7M loss, LastPass $35M theft, DNS poisoning, npm WhatsApp trap.
The Hacker News
December 29, 2025
MongoDB Vulnerability CVE-2025-14847 Under Active Exploitation Worldwide
A critical MongoDB flaw, CVE-2025-14847, is under active exploitation, allowing unauthenticated data leaks from 87,000+ vulnerable servers w...
The Hacker News
December 29, 2025
27 Malicious npm Packages Used as Phishing Infrastructure to Steal Login Credentials
Researchers uncovered 27 malicious npm packages used over five months to host phishing pages that steal credentials from targeted organizati...
The Hacker News
December 29, 2025
Traditional Security Frameworks Leave Organizations Exposed to AI-Specific Attack Vectors
AI-driven attacks leaked 23.77 million secrets in 2024, revealing that NIST, ISO, and CIS frameworks lack coverage for AI-specific threats.
The Hacker News
December 27, 2025
New MongoDB Flaw Lets Unauthenticated Attackers Read Uninitialized Memory
High-severity CVE-2025-14847 allows unauthenticated attackers to read uninitialized heap memory in MongoDB due to a zlib compression handlin...- 1
- 2
Showing 50 results of 52 — Page 1