# Archive
Browse past daily curated stories
Friday, October 16, 2026
-
1The Hacker News generalCitizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads
Citizen Lab researchers confirmed that Candiru, an Israeli mercenary spyware vendor, infected devices at Al Jazeera through zero-click attacks delivered via ordinary online ads — no user interaction required, with the exploit triggering the moment an ad loaded, sometimes entirely off-screen. This marks the first confirmed case of mercenary spyware delivered through targeted advertising infrastructure, raising serious implications for ad networks, regulators, and any organization whose staff consume online media.
-
2The Hacker News generalPalo Alto Networks Patches PAN-OS Authenticated RCE Flaw Amid Active Exploitation
Palo Alto Networks patched CVE-2026-0322 (CVSS 8.6), an actively exploited RCE vulnerability in the PAN-OS management interface, with the company confirming limited exploitation against customer firewalls and releasing IoCs. Security teams running PAN-OS firewalls should treat this as urgent, as management-plane RCE on perimeter devices provides attackers a foothold into the entire protected network.
-
3The Hacker News generalCisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
Cisco disclosed and warned of active exploitation of a critical flaw in Cisco Secure Email Gateway that allows an unauthenticated remote attacker to write arbitrary files to the appliance OS and execute commands as root via a specially crafted email attachment. Because the attack vector requires only sending an email through the gateway — no login needed — the exposure is extremely broad for any organization using this product for inbound mail filtering.
-
4CyberScoop generalMicrosoft drops an actively exploited zero-day among record high of 1,413 vulnerabilities
Microsoft's October 2026 Patch Tuesday addressed a record-breaking 1,413 vulnerabilities in a single month, surpassing any prior annual total, with nearly 80% affecting Windows and at least one zero-day under active exploitation included in the release. Security teams face an unprecedented patching workload and should immediately prioritize the actively exploited zero-day and any critical-rated Windows flaws in this release.
-
5The Hacker News generalU.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
The U.S. DOJ charged 14 individuals — including U.S. citizens and Chinese nationals — and seized approximately 187 computers and 40+ laptop farms used in North Korea's IT worker fraud scheme, which defrauded more than 70 U.S. companies via fraudulent remote employment. The operation demonstrates the continued scale of DPRK's revenue-generating IT worker infiltration program and the domestic infrastructure enabling it.
-
6The Hacker News generalNext.js Ships Out-of-Band Patch for Two Critical RCE Flaws in Caching and SVG Processing
Next.js issued an out-of-band patch on October 14 fixing two critical unauthenticated RCE flaws — one in React Server Components and one in librsvg via the sharp image-processing package — plus a high-severity DoS flaw. Any Next.js deployment processing SVG images or using React Server Components is potentially exposed, and the out-of-band nature of the release signals the severity warrants immediate upgrade.
-
7The Hacker News generalHackers Backdoor Nextcloud Servers Through Critical Flaw in Collabora’s Built-in CODE App
Attackers exploited CVE-2026-110447, a critical RCE flaw in the Collabora Online Built-in CODE Server (richdocumentscode) Nextcloud app, to plant web shells on Nextcloud servers, with the first confirmed attack logged on September 10, 2026 and at least three administrators independently reporting compromises on GitHub. Nextcloud administrators running the Collabora CODE integration should patch immediately and audit servers for web shell indicators.
-
8The Hacker News generalMicrosoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft, alongside Health-ISAC, Japan's JC3, Cloudflare, Oracle, Proofpoint, and others, disrupted three Chinese-linked phishing kit operations — CoGUI (aka NX/FA), Haozi (aka Phoenix), and Iron Man System — responsible for over 1 billion scam messages since January 2026, seizing and redirecting associated domains via U.S. court order. The scale and cross-sector coordination of this takedown make it a significant reference point for defenders tracking phishing-as-a-service infrastructure.
-
9Ars Technica Security generalFridge hack costing millions and sparking fires stemmed from poor security
A cyberattack on internet-exposed, unpatched Danfoss and Copeland/Dixell refrigeration controllers forced freezer units across roughly 700 French supermarkets to heat to 50°C (120°F) overnight, causing millions in food spoilage losses and triggering fires in some cases. The incident underscores the critical risk of OT devices managed by third parties running outdated firmware with direct internet exposure — a pattern common across European retail infrastructure.
-
10BleepingComputer generalUK Legal Aid Agency: Hackers stole records dating back to 1978
A forensic review of the April 2025 breach of the UK Legal Aid Agency (LAA), an executive arm of the Ministry of Justice, revealed stolen records dating back to 1978 — far older than initially disclosed — with most compromised data covering applications, claims, and payments submitted between 2007 and 2025. The expanded scope implicates decades of sensitive legal aid applicant data and signals that the original breach assessment significantly underestimated the attacker's access.