The Hacker News (@TheHackersNews) / X

The Hacker News

44.2K posts

The Hacker News

@TheHackersNews

The #1 trusted source for cybersecurity news, insights, and analysis — built for defenders and trusted by decision-makers.

The Internet

Joined October 2010

Pinned
The Hacker News
@TheHackersNews
Jun 10
Anthropic released its most powerful Claude AI yet — but not everyone gets the same version. 🛡️ Fable 5 is for the public, with limits on risky cyber requests. 🔥 Mythos 5 is for vetted defenders, with those cyber limits removed. See what Anthropic is trying to stop:
18K
The Hacker News
@TheHackersNews
35m
🛑 A stock app in Vietnam pushed a routine update. It was malware. ESET says OceanLotus hijacked FireAnt Metakit's own update server to plant the SPECTRALVIPER backdoor on select investors. The flaw? No signature check. So the app trusted it. Read:
OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack
From thehackernews.com
1.9K
The Hacker News
@TheHackersNews
3h
💪 GitHub is tightening npm security. In npm 12, "npm install" won't run dependency install scripts by default. Git and remote URL dependencies will need approval too. The goal: cut supply chain risk from compromised packages. See what's changing:
GitHub to Disable npm Install Scripts by Default to Stop Supply Chain Attacks
From thehackernews.com
6K
The Hacker News
@TheHackersNews
18h
UPDATE: Microsoft has patched the actively exploited on-prem Exchange flaw (CVE-2026-42897). Patch now, and keep the existing mitigation on for extra protection. Affects Exchange Server 2016, 2019, and SE. Details 👇
On-Prem Microsoft Exchange Server CVE-2026-42897 Exploited via Crafted Email
From thehackernews.com
8.2K
The Hacker News
@TheHackersNews
18h
🤖 A China-linked botnet survived a U.S. takedown — and got bigger. JDY now runs on 1,500+ hacked SOHO and IoT devices, scanning exposed services and feeding targeting data to Chinese threat actors. Read the full story:
China-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance
From thehackernews.com
7.3K
The Hacker News
@TheHackersNews
19h
🚨 Ivanti, Fortinet, and SAP releases patches for critical flaws that could enable code execution, admin takeover, or data exposure. The worst one hits Ivanti Sentry, a CVSS 10.0 remote root-level RCE with no login needed. FortiSandbox got a 9.1 command injection fix, and SAP
15K
The Hacker News
@TheHackersNews
19h
⚠️ An unpatched Langflow flaw is now being exploited in the wild. The catch: default auto-login can let attackers reach the vulnerable endpoint without credentials, then run their own code. About 7,000 Langflow instances are exposed online. Read:
Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE
From thehackernews.com
6K
The Hacker News
@TheHackersNews
19h
🚨 A serious flaw in Arista switches is being exploited right now — and Arista says it won't fix it. It's one of 3 actively exploited bugs CISA just flagged, alongside Cisco and Google Chrome. Federal agencies have until June 23 to act. Read:
CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation
From thehackernews.com
7K
The Hacker News
@TheHackersNews
19h
The Forrester Wave™: Governance, Risk, And Compliance Platforms, Q2 2026 The speed of risk has accelerated. With AI and automation, businesses need to change the pace in order to not just keep up, but stay ahead. 🌊 Access your complimentary copy of The Forrester Wave™:
4.8K
The Hacker News
@TheHackersNews
23h
🔒 A clean pentest report can be the most dangerous thing in your inbox. Your tool proves an attacker could move laterally. It never tells you if your EDR blocked it or your SIEM caught it. A reachable path is not a defended one. Join THN + Picus Security to see what your tool
6.8K
The Hacker News
@TheHackersNews
Jun 10
🚨 Microsoft just dropped a record 206 security fixes. Three bugs were already public. 39 are rated Critical. Some can let attackers run code over the network or bypass #BitLocker. This is the Patch Tuesday list admins should not skim. See what Microsoft fixed:
17K
The Hacker News
@TheHackersNews
Jun 10
🚨 Researchers built an AI agent that hacks Salesforce sites on its own. Give it a URL, and it does the rest. @recolabs_ai's Nitay Bachrach showed it maps the site, finds the flaws, writes the exploit, and pulls real data. One unauthenticated request leaked a partner's name,
5.9K
The Hacker News
@TheHackersNews
Jun 10
🛑 ServiceNow patched a flaw that could let unauthenticated users gain deeper access to certain instances. It found evidence of successful instance-table queries against a subset of customers. Still no CVE. What affected customers need to know:
ServiceNow Flaw Exploited to Gain Unauthorized Access to Customer Instances
From thehackernews.com
8.5K