Identity Visibility in 2026: The Foundation of Identity Security
Identity visibility is a starting point for modern identity security, because stolen and misused credentials are among the most frequently reported initial access vectors in…
Category: TheHackerNews
Claude Opus 5 Helped Researchers Take Over OpenAI Staff Accounts via Chained Flaws
Three researchers at the security firm Hacktron used Anthropic’s Claude Opus 5 to chain two flaws and take over the ChatGPT and Codex accounts of…
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
Ravie LakshmananSep 19, 2026Vulnerability / Web Security A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability…
Transparent Tribe Deploys New Rust Backdoor Using Private GitHub Repositories for C2
Ravie LakshmananSep 18, 2026Malware / Cyber Espionage The Pakistan-aligned threat group tracked as Transparent Tribe (aka APT36 and Earth Karkaddan) has been attributed to a…
Public Exploits Released for Four Linux Kernel Flaws That Enable Local Root
A security researcher has released working exploit code for four Linux kernel flaws that each let a local user gain root, the highest level of…
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Swati KhandelwalSep 18, 2026Vulnerability / Web Security WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which…
Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation
Ravie LakshmananSep 18, 2026Vulnerability / Cloud Security Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to…
RatHat Android Malware Abuses ADB to Retain Shell Access After Uninstall
Ravie LakshmananSep 18, 2026Mobile Security / Malware Cybersecurity researchers have flagged a new Android malware called RatHat that’s assessed to be operated by China-based threat…
Critical Check Point Management Flaw Lets Unauthenticated Attackers Run Code as Root
A critical vulnerability in Check Point’s Security Management and Log Servers could allow an attacker without login credentials to run code as root on those…
CISO’s Expert Guide to Agentic Pentesting for Websites
Attackers now weaponize new vulnerabilities in about five days (Mandiant, part of Google Cloud). The median organization takes 43 days to patch one (Verizon DBIR…
Can You Prove a New CVE Is Exploitable Before Attackers Do? Learn How in This Webinar
The Hacker NewsSep 17, 2026Security Operations / Artificial Intelligence A new CVE drops. Your scanner finds it. The severity score looks ugly. But that still…
Critical Unbound DNSSEC Validator Flaw Could Allow RCE via a Malicious DNS Zone
Swati KhandelwalSep 17, 2026Vulnerability / DNS Security Every release of the Unbound DNS resolver before 1.26.1 has a critical heap overflow in its DNSSEC validator,…