Hackers just turned GitHub into their command center.

When police take down their servers, the malware just… reboots itself from GitHub.

The twist? It hides configs inside images using steganography. This isn’t a glitch — it’s resilience by design.

Read how it works → https://thehackernews.com/2025/10/astaroth-banking-trojan-abuses-github.html

⚠️ Microsoft just locked down Internet Explorer mode in Edge after real-world zero-day attacks.

Hackers abused the old IE engine (Chakra) to hijack devices — bypassing modern browser defenses.

Full story ↓ https://thehackernews.com/2025/10/microsoft-locks-down-ie-mode-after.html

🟥 RondoDox Botnet just went nuclear.

It’s now exploiting 56 vulnerabilities across 30+ vendors — from routers to web servers.

The irony? 18 of those flaws don’t even have CVEs yet.

Learn more → https://thehackernews.com/2025/10/researchers-warn-rondodox-botnet-is.html

Your WAF can’t see this.

Attackers are skimming payment data right now through unmonitored JavaScript—while your dashboards stay clean.

The worst part? It’s happening in your customers’ browsers.

See what every retailer must fix before Black Friday ↓ https://thehackernews.com/2025/10/why-unmonitored-javascript-is-your.html

⚡ Latest Weekly Recap is out...

🚨 Oracle 0-Day exploited
🤖 Nation-state AI abuse on the rise
🎣 npm phishing spreading fast
💀 New ransomware cartel emerges

…and more

The threat landscape is moving fast — here’s what defenders need to know.

🔗 https://thehackernews.com/2025/10/weekly-recap-whatsapp-worm-critical.html

🚨 Threat Alert: A new group, TA585, is running end-to-end phishing campaigns delivering MonsterV2 malware.

No middlemen. Just pure, in-house cybercrime ops.

Phishing → fake CAPTCHAs → PowerShell payloads → MonsterV2.

Learn how their stack works → https://thehackernews.com/2025/10/researchers-expose-ta585s-monsterv2.html

🚨 Attackers are turning Discord into a command center — using webhooks to steal API keys and config files right from npm, PyPI, and Ruby installs.

⚙️ North Korean actors even pushed 300+ fake packages with 50K+ downloads.

Details here → https://thehackernews.com/2025/10/npm-pypi-and-rubygems-packages-found.html

⚡ New Android exploit “Pixnapping” steals 2FA codes via GPU side-channels.

— No special permissions
— Works across apps (Maps, Authenticator, etc.)
— Full 2FA capture in ~30s

Read the full story ↓ https://thehackernews.com/2025/10/new-pixnapping-android-flaw-lets-rogue.html

🧩 AMD’s “secure” virtualization can be broken with a single memory write.

A new flaw, RMPocalypse (CVE-2025-0033), lets attackers corrupt the Reverse Map Table and steal data from virtual machines — all through one 8-byte overwrite.

Read the details ↓ https://thehackernews.com/2025/10/rmpocalypse-single-8-byte-write.html

🤖 AI lets attackers map your environment before sending a payload.

No exploits needed — your JS, APIs, and error logs are enough. Harmless data is now reconnaissance fuel.

See how it changes defense strategy ↓ https://thehackernews.com/2025/10/what-ai-reveals-about-web-applications.html

⚠️ Security training ≠ security.

Training teaches people to see risk — threat hunting proves whether it still exists. Real security starts before the first alert.

🔍 Don’t just educate. Learn how to validate ↓ https://thehackernews.com/2025/10/moving-beyond-awareness-how-threat.html

🚨 A Chinese APT hid inside ArcGIS for over a year.

They turned a legit Java extension into a web shell.

🔑 Added a hardcoded key → exclusive access
💾 Hid it in backups → survived restores

That’s what “living off the land” really means ↓ https://thehackernews.com/2025/10/chinese-hackers-exploit-arcgis-server.html

⚠️ Heads-up! SAP just re-patched a critical CVSS 10.0 flaw (CVE-2025-42944) in NetWeaver AS Java — a deserialization bug that lets attackers execute commands without authentication.

Apply. The. Fix. → https://thehackernews.com/2025/10/new-sap-netweaver-bug-lets-attackers.html

🍪 A cookie that spawns a shell 💀

A critical flaw (CVE-2025-2611, CVSS 9.3) in ICTBroadcast autodialer software is under active exploitation.

Attackers inject commands via the BROADCAST session cookie for unauthenticated remote code execution.

No patch yet — check your stack → https://thehackernews.com/2025/10/hackers-target-ictbroadcast-servers-via.html

~200 servers are exposed.

🔥 Agentic AI isn’t just automating—it’s thinking and acting.

Zscaler’s CEO says it’s a bigger shift than cloud or IoT.

The upside? Faster support and instant threat response.
The risk? Rogue AIs scanning your network right now.

Learn why Zero Trust isn’t optional anymore → https://thehackernews.com/videos/2025/10/exploring-agentic-ai-innovation-meets.html

⚙️ If you run industrial gear — check your Red Lion RTUs.

Two CVEs (both 10/10) let anyone pop root via one open port. Water, energy, transport — all at risk.

Patch ASAP. Details here → https://thehackernews.com/2025/10/two-cvss-100-bugs-in-red-lion-rtus.html