Home / Cybersecurity / ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token…
ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories
thehackernews.com Oct 29, 2026

ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories

Curated by · TechCapsules ·

AI-summarised brief · reviewed before publication

This week’s ThreatsDay bulletin highlighted a mix of sophisticated exploits and basic security lapses. Wordfence reported ongoing scans for the PHP2Shell vulnerabilities (CVE‑2026‑109618/109619) across more than five million WordPress sites, though no confirmed compromises were found. Hudson Rock’s investigation into the FortiBleed 2.0 campaign uncovered 975 new domains and over 40,000 exposed credentials, including thousands of Active Directory LDAP bind records, from 1,703 FortiGate configuration files dated February 2026. Infoblox revealed two domain‑shadowing operations that inserted illegal gambling pages beneath legitimate school and government domains, leveraging DNS admin access for SEO gain. Bank of America warned customers against sharing login details with AI agents. Google announced that future Android versions will restrict direct WRITE_CONTACTS permission, urging developers to use contact intents. A scan of 7.25 million Gitee repositories exposed 26,400 live credentials, among them an enterprise AI platform admin token. Fortinet released coordinated patches for FortiOS, FortiManager and FortiAnalyzer, discovered via AI‑assisted vulnerability research.

💡 Why It Matters

  • · The revelations expose how attackers exploit both legacy bugs and modern cloud‑native misconfigurations, forcing vendors and organizations to tighten defenses across legacy code, DNS management and AI‑driven development pipelines.
Capsules Cybersecurity
Read full article on thehackernews.com
More in Cybersecurity →
Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners
thehackernews.com · Oct 29

Fake ChatGPT and Claude Apps Abuse Signed Executables to Deploy Crypto Miners

Threat actors behind the Yoba campaign are masquerading malicious loaders and XMRig cryptocurrency miners as AI desktop applications for Anthropic Claude and OpenAI ChatGPT. They create fake GitHub repositories—such as “GPT‑5.6 Sol,” “GPT‑6 Astra,” and “Claude Opus”—and host ZIP files that contain two DLLs, YobaDropper and YobaLoader. The DLLs employ DLL sideloading, placing themselves beside legitimate signed executables like OpenAI’s Setup.exe and Anthropic’s wmpdmc.exe, then use checksum checks to ensure they run only in the intended host. Advanced anti‑analysis measures include a 12‑day sleep loop, language and keyboard‑layout filters that skip several post‑Soviet states, and DoH‑based C2 traffic. The loader injects the miner into svchost.exe and establishes persistence via a scheduled task. The first repository appeared in July 2026, with malicious releases posted in August.

💡 By exploiting trusted AI branding and GitHub’s reputation, the campaign evades casual scrutiny and blends crypto‑mining traffic with legitimate user activity, making detection far more difficult.

Up to 350,000 Macs exposed by a forgotten Popcorn Time updater
appleinsider.com · Oct 29

Up to 350,000 Macs exposed by a forgotten Popcorn Time updater

Eye Research uncovered that an abandoned Popcorn Time updater exposed up to 350,000 Macs to remote takeover, allowing attackers to run malicious code with root privileges. The vulnerability, CVE‑2026‑30612, stemmed from an unencrypted HTTP updater that accepted unsigned code. Between November 2025 and March 2026, researchers deployed a patch that disabled the updater on affected machines, distributing over two million updates before ceasing the operation in March 2026. The incident highlighted risks from legacy software infrastructure.

💡 The breach shows how dormant update mechanisms can become powerful attack vectors, underscoring the need for continuous monitoring of legacy software. It also demonstrates the ethical complexities researchers face when intervening on users’ systems without explicit consent.

China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility
thehackernews.com · Oct 29

China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility

The U.S. Cybersecurity and Infrastructure Security Agency added Broadcom VMware ESX CVE‑2026‑41709 to its Known Exploited Vulnerabilities catalog after CrowdStrike confirmed that the China‑linked threat actor Warp Panda weaponized the flaw to evade audit logging in early 2026. The vulnerability, with a CVSS score of 2.7, allowed administrators to perform actions without being recorded. Broadcom patched the issue in later releases, and CISA urged Federal Civilian Executive Branch agencies to apply the fix by November 11, 2026.

💡 The incident exposes how low‑severity flaws can be leveraged for stealthy espionage, underscoring the need for rapid patching and enhanced audit visibility in critical infrastructure.

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption Keys
thehackernews.com · Oct 29

Hackers Exploited Cisco SD-WAN Flaw to Plant Malware Built to Steal Encryption…

Cisco disclosed a critical SD‑WAN flaw (CVE‑2026‑20127) that allows unauthenticated attackers to bypass authentication and gain administrative privileges on Catalyst SD‑WAN controllers. Exploited by a group linked to Volt Typhoon, the attackers deployed custom malware, KeyDrift, which infiltrates the controller’s vdaemon process, extracts AES‑256 encryption keys, encrypts them with RSA, and exfiltrates the data over UDP. The vulnerability, rated CVSS 10.0, affects on‑premises and cloud‑hosted SD‑WAN deployments, and Cisco has released patches for affected software trains.

💡 The breach exposes the core encryption mechanism that secures inter‑site traffic, potentially allowing attackers to decrypt sensitive data across an organization’s entire network. This undermines the foundational trust model of SD‑WAN architectures and signals a broader threat to critical infrastructure sectors.

GitHub Launches npm Firewall to Block Malicious Packages Before Installation
thehackernews.com · Oct 29

GitHub Launches npm Firewall to Block Malicious Packages Before Installation

GitHub announced a preview package firewall that blocks suspicious npm packages at install time. The firewall, available to all GitHub Enterprise Cloud customers, sits between endpoints or internal registries and upstream repositories, inspecting metadata and downloads for malicious activity. Administrators configure policy controls, such as a minimum package age cooldown ranging from 1 to 365 days, and can request exceptions for blocked packages. The feature aims to protect automated CI/CD pipelines and AI agents from malware introduced through newly published dependencies.

💡 By enforcing a cooldown period, the firewall gives security teams critical time to detect and respond to malicious releases before they propagate through automated build processes.

Hacker stole personnel data about thousands of Homeland Security employees, including CBP and ICE agents
techcrunch.com · Oct 29

Hacker stole personnel data about thousands of Homeland Security employees, including CBP…

A hacker using the alias “Department of Peace” released personal data for more than 40,000 U.S. Department of Homeland Security (DHS) employees after extracting it from an Okta single sign‑on system earlier this year. The leak includes names, job titles, email addresses, phone numbers and office locations for staff across DHS agencies, notably 21,000 Customs and Border Protection workers, 10,000 Immigration and Customs Enforcement personnel, and nearly 1,000 Cybersecurity and Infrastructure Security Agency employees. The dataset also contains login records that reveal which internal applications each user could access. The breach, verified by TechCrunch and posted to DDoSecrets, follows two prior DHS incidents and comes amid heightened scrutiny of the department’s immigration enforcement ahead of the midterm elections. DHS confirmed awareness of a “potential breach” and is investigating; Okta said it sees no evidence its systems were compromised.

💡 The exposure of authentication details gives threat actors a roadmap to infiltrate critical immigration and border‑security systems, raising immediate national‑security concerns.