Cyber Trends

The Hacker News Most trusted, widely-read independent cybersecurity news source for everyone; supported by hackers and IT professionals — Send TIPs to admin@thehackernews.com

• 
  Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens

  by info@thehackernews.com (The Hacker News) on October 27, 2026 at 12:09 pm

  Microsoft has fixed a flaw in its Authenticator app for Android that let a malicious app with no permissions pose as a trusted Microsoft app, such as Teams, and collect sign-in tokens for a victim's work account. Microsoft tracks the flaw as CVE-2026-80097 and fixed it in Authenticator for Android version 6.2606.4246, so anyone using the app should update. In the researchers' tests,

• 
  Keystone to Destroy 18,835 Hardware Wallets After Hackers Steal Device Verification Key

  by info@thehackernews.com (The Hacker News) on October 27, 2026 at 11:46 am

  An attacker who gained access to Keystone's website obtained the key that its hardware wallets use to prove they are genuine, the company said in a statement on October 26. Someone with that key could build counterfeit devices that pass the online check owners use to verify a Keystone. A buyer who trusted a counterfeit could have their crypto stolen, but the incident did not involve

• 
  AI-Generated Fake Login Pages Are Making Account Takeovers Easier

  by info@thehackernews.com (The Hacker News) on October 27, 2026 at 11:32 am

  Fake login pages are nothing new, but generative AI is making them easier to build and more convincing. Attackers can recreate familiar login screens, impersonate trusted brands and tailor phishing attempts to specific employees or organizations.  Some fake login pages go beyond stealing passwords. They can also capture MFA codes or hijack authenticated sessions, allowing attackers to gain

• 
  Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption

  by info@thehackernews.com (The Hacker News) on October 27, 2026 at 11:32 am

  The North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors. According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It's assessed to pick up

• 
  Australia Gets Into Amadey Malware Backend, Cuts Off Access to 180,000 Infected Computers

  by info@thehackernews.com (The Hacker News) on October 27, 2026 at 9:33 am

  A criminal using the Amadey malware can no longer access or steal data from 180,000 infected computers around the world, including some in Australia, the Australian Signals Directorate (ASD) says. The agency's operators gained access to the criminal's operation's backend and cut it off from those computers. "The next steps that we took were to disconnect that Amadey controller from all those

• 
  OpenAI Compaction Flaw Let Researchers Bypass Hidden Reasoning Protections

  by info@thehackernews.com (The Hacker News) on October 27, 2026 at 8:22 am

  OpenAI's compaction feature, which shrinks a long conversation to save space, could be turned into a way to copy a model's hidden reasoning out in plain text, security firm Xint has shown. OpenAI's reasoning models work through a problem before answering, and the service normally returns only the raw reasoning as an encrypted item the user cannot read. The method got past

• 
  Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses

  by info@thehackernews.com (The Hacker News) on October 27, 2026 at 6:34 am

  The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with access to the video stream, changing the device configuration and creating third-party accounts have been recorded," the State Special Communications Service of Ukraine (SSSCIP)

• 
  CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

  by info@thehackernews.com (The Hacker News) on October 27, 2026 at 4:37 am

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The PHP vulnerabilities, both rated 9.2 on the CVSS scoring system, facilitate unauthenticated remote code execution on affected deployments - CVE-2026-109618 - An out-of-memory