The Hacker News

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

OpenSSL fixed HollowByte after 11-byte TLS requests could strand memory on glibc systems, but shipped no CVE, advisory, or changelog note.

Anthropic's Claude Mythos Finds Thousands of Zero-Day Flaws Across Major Systems

Claude Mythos finds thousands of zero-days as Anthropic launches Project Glasswing, enhancing defenses but exposing AI security risks.

We Scanned 1 Million Exposed AI Services. Here's How Bad the Security Actually Is

AI infrastructure exposes 1M services from 2M hosts due to weak defaults, increasing risk of data leaks and system compromise

Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account

Axios 1.14.1 and 0.30.4 injected malicious plain-crypto-js@4.2.1 after npm compromise on March 31, 2026, deploying cross-platform RAT malware.

ShowDoc RCE Flaw CVE-2025-0520 Actively Exploited on Unpatched Servers

ShowDoc CVE-2025-0520 exploited due to unpatched versions before 2.8.7, enabling remote code execution on 2,000+ instances.

April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More

OpenAI Revokes macOS App Certificate After Malicious Axios Supply Chain Incident

OpenAI revoked its macOS signing certificate after a malicious Axios dependency incident on March 31, 2026, preventing potential software misuse.

FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts

FBI dismantles W3LL phishing network targeting 17,000 victims; crackdown disrupts $20M fraud scheme.

Fortinet Patches Actively Exploited CVE-2026-35616 in FortiClient EMS

CVE-2026-35616 (CVSS 9.1) exploited since March 31, 2026, affects FortiClient EMS 7.4.5–7.4.6, enabling privilege escalation.

CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software

CISA adds six exploited vulnerabilities, including Fortinet and Exchange flaws, requiring FCEB patching by April 27, 2026.

$285 Million Drift Hack Traced to Six-Month DPRK Social Engineering Operation

$285M stolen after six-month DPRK social engineering campaign began fall 2025, exposing Drift’s contributors and cloud assets.

China-Linked TA416 Targets European Governments with PlugX and OAuth-Based Phishing

TA416 targeted European governments from mid-2025 using PlugX and OAuth abuse, enabling cyber espionage against EU and NATO entities.

A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices

Malicious SIM cards can use RUN AT to execute modem commands on cellular IoT devices, including EV chargers, routers, and telematics units.

Flowise AI Agent Builder Under Active CVSS 10.0 RCE Exploitation; 12,000+ Instances Exposed

CVE-2025-59528 exploited in Flowise for over six months across 12,000+ exposed instances, enabling full system compromise.

Your MTTD Looks Great. Your Post-Alert Gap Doesn't

AI-driven attacks exploiting zero-days and 29-minute breakout times expose SOC investigation gaps, accelerating the shift to automated response.

Russian State-Linked APT28 Exploits SOHO Routers in Global DNS Hijacking Campaign

APT28 exploits SOHO routers for global DNS hijacking and adversary-in-the-middle attacks, enabling credential theft and espionage.

BKA Identifies REvil Leaders Behind 130 German Ransomware Attacks

BKA identified REvil leaders tied to 130 German attacks causing €35.4M damage, exposing key ransomware figures.

Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign

Over 1,000 exposed ComfyUI instances exploited via unauthenticated code execution, enabling Monero mining and botnet expansion.

DeepLoad Malware Uses ClickFix and WMI Persistence to Steal Browser Credentials

DeepLoad exploits ClickFix and WMI persistence to steal credentials, enabling stealth reinfection after three days.

108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users

108 Chrome extensions routed stolen Google and Telegram data to shared C2 infrastructure, impacting 20,000 users.

New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released

Two Composer flaws (CVE-2026-40176, CVE-2026-40261) allow command execution via Perforce configurations, prompting urgent updates.

GitHub 'Verified' Commits Can Be Rewritten Into New Hashes Without Breaking Signatures

Research shows signed Git commits can be re-encoded into fresh GitHub Verified hashes without changing files or breaking signatures.

How LiteLLM Turned Developer Machines Into Credential Vaults for Attackers

LiteLLM 1.82.7–1.82.8 supply chain attack exposed 33,185 secrets across 6,943 machines, leaving 3,760 valid credentials active.

Analysis of 216M Security Findings Shows a 4x Increase In Critical Risk (2026 Report)

Critical risk surged nearly 400% as AI-driven development increased vulnerabilities across 250 organizations.

⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More

Stay ahead of the logs with our Monday Recap. We break down active Adobe 0-days, North Korean crypto stings, and critical CVEs you need to patch today

Deterministic + Agentic AI: The Architecture Exposure Validation Requires

All CISOs use AI in 2026 survey, Pentera report shows, driving hybrid deterministic security validation models.

AI-Driven Pushpaganda Scam Exploits Google Discover to Spread Scareware and Ad Fraud

Pushpaganda exploits Google Discover using AI-generated content, driving scams and ad fraud globally, prompting Google to deploy a security fix.

CPUID Breach Distributes STX RAT via Trojanized CPU-Z and HWMonitor Downloads

CPUID breach served STX RAT via trojanized CPU-Z downloads on April 9–10, impacting 150+ victims and multiple industries.

Ransomware Negotiator Gets 70 Months in Prison for Aiding BlackCat Attacks

Former ransomware negotiator Angelo Martino gets 70 months for giving victim negotiation data to BlackCat operators and aiding extortion.

China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware

Storm-1175 exploits 16+ CVEs since 2023, including zero-days, enabling rapid Medusa ransomware attacks within 24 hours.

Microsoft Details Cookie-Controlled PHP Web Shells Persisting via Cron on Linux Servers

Cookie-gated PHP web shells enable persistent Linux RCE via cron-based re-creation, reducing detection in routine traffic logs.

DPRK-Linked Hackers Use GitHub as C2 in Multi-Stage Attacks Targeting South Korea

DPRK-linked actors use GitHub C2 and LNK phishing in South Korea, enabling persistent PowerShell control and data exfiltration.

Google Adds Rust-Based DNS Parser into Pixel 10 Modem to Enhance Security

Google adds a Rust-based DNS parser to Pixel 10 modem firmware, reducing memory vulnerabilities and strengthening defenses against baseband exploits.

Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover

CVE-2026-33032 exposes nginx-ui to unauthenticated takeover via MCP endpoint, impacting 2,600+ instances with active exploitation.

Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities

Microsoft fixes 169 vulnerabilities including exploited SharePoint CVE-2026-32201, prompting CISA remediation by April 28, 2026.

Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads

Mirax Android RAT spreads via Meta ads reaching 220,000 accounts, enabling proxy abuse and fraud operations.

North Korea's APT37 Uses Facebook Social Engineering to Deliver RokRAT Malware

APT37 spreads RokRAT via Facebook and trojanized PDFelement accounts created Nov 10, 2025, enabling espionage and data theft.

OpenAI Launches GPT-5.4-Cyber with Expanded Access for Security Teams

GPT-5.4-Cyber launch expands defender access and helped fix 3,000+ vulnerabilities, strengthening proactive cybersecurity defenses.

The Hidden Cost of Recurring Credential Incidents

Recurring credential incidents drive operational costs as password resets make up 30% of helpdesk tickets, impacting productivity and security.

Iran-Linked Password-Spraying Campaign Targets 300+ Israeli Microsoft 365 Organizations

Iran-linked attacks hit 300+ Israeli M365 orgs in March 2026, reviving ransomware campaigns and escalating regional cyber risks.

36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

36 npm packages disguised as Strapi plugins exploit Redis and PostgreSQL via postinstall scripts, enabling persistent access and data theft.

Qilin and Warlock Ransomware Use Vulnerable Drivers to Disable 300+ EDR Tools

Qilin disables 300+ EDR drivers using BYOVD in 2025 attacks, delaying encryption six days, increasing breach impact.

[Webinar] How to Close Identity Gaps in 2026 Before AI Exploits Enterprise Risk

Hundreds of disconnected apps persist in 2026 enterprises, Ponemon finds, enabling AI agents to amplify credential risks and expand attack surfaces.

Multi-OS Cyberattacks: How SOCs Close a Critical Risk in 3 Steps

ANY.RUN cuts MTTR by 21 minutes per case, reducing escalations and breach exposure in multi-OS attacks.

JanelaRAT Malware Targets Latin American Banks with 14,739 Attacks in Brazil in 2025

JanelaRAT hits Latin American banks with 14,739 attacks in Brazil in 2025, enabling credential theft and financial espionage

⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More

Phishing surge, LinkedIn tracking claims, spyware use, and rising stealers expose growing abuse of trusted systems.

New GPUBreach Attack Enables Full CPU Privilege Escalation via GDDR6 Bit-Flips

GPUBreach achieves full CPU privilege escalation via GDDR6 RowHammer in July 2025 research, threatening cloud AI systems.

Docker CVE-2026-34040 Lets Attackers Bypass Authorization and Gain Host Access

Docker CVE-2026-34040 enables AuthZ bypass via padded requests, risking host compromise; fixed in version 29.3.1.