⚠️ AI just overtook shadow IT.

New data shows generative AI is now the #1 vector for corporate data loss — bigger than unmanaged SaaS or file sharing.

And the main culprit isn’t uploads. It’s copy/paste → https://thehackernews.com/2025/10/new-research-ai-is-already-1-data.html

🔥 Google just gave AI the power to patch your code — automatically.

DeepMind’s new AI agent, CodeMender, has already rewritten 4.5+ million lines of code across open-source projects & shipped 72 security fixes.

The next bug bounty? Might go to a bot ↓ https://thehackernews.com/2025/10/googles-new-ai-doesnt-just-find.html

A fake job offer is stealing Facebook business accounts.

Hackers posing as recruiters are sending “Marriott job descriptions” that secretly install Vampire Bot — a Go-based malware that screenshots your system.

It’s still active. ↓ https://thehackernews.com/2025/10/batshadow-group-uses-new-go-based.html

🚨 OpenAI just disrupted 3 clusters abusing ChatGPT for malware—Russia, North Korea, China. Scammers even stripped em-dashes to dodge “AI-written” tells.

RAT/C2 snippets, Telegram exfil, macOS Finder ext.

The iteration pattern that fingerprints them ↓ https://thehackernews.com/2025/10/openai-disrupts-russian-north-korean.html

🚨 A single design flaw in Figma’s MCP server just opened a path to remote code execution.

Developers using AI-powered tools like Cursor were exposed for months.

The fix is out — details here ↓ https://thehackernews.com/2025/10/severe-figma-mcp-vulnerability-lets.html

💼 The board doesn’t speak ‘cyber.’

And that’s why even the smartest CISOs lose funding.

A new course is teaching security leaders how to turn threat data into boardroom decisions — before compliance fines or missed budgets hit.

⚡ Learn more → https://thehackernews.com/expert-insights/2025/10/cracking-boardroom-code-helping-cisos.html

💣 Three of the world’s most dangerous ransomware gangs just joined forces.

LockBit, DragonForce, and Qilin are pooling tools, infrastructure, and targets — a move that could supercharge attacks on critical sectors.

Full story → https://thehackernews.com/2025/10/lockbit-qilin-and-dragonforce-join.html

🎃 This Halloween, face your password nightmares.

Think your passwords are safe? Most IT teams did—until the breach.

Join “Tales from the Password Graveyard” — real stories, real lessons, and how to stop the next one.

Live webinar — don’t miss it → https://thehackernews.com/2025/10/step-into-password-graveyard-if-you.html

AI is now writing the next wave of cyberattacks.

The irony? Most defenders still can’t use it effectively.
The attackers are faster—and smarter.

Here’s how to fight back ↓ https://thehackernews.com/2025/09/automation-is-redefining-pentest.html

China-linked hackers just turned a trusted open-source tool into a weapon.

They used log poisoning to slip a web shell onto servers — and dropped Gh0st RAT without custom malware.

100+ servers hit, Gh0st RAT deployed, and the control panel? Written in Russian.

Find details here → https://thehackernews.com/2025/10/chinese-hackers-weaponize-open-source.html

🚨 New Threat ALERT! Hackers are exploiting WordPress themes with fake Cloudflare checks, redirecting users to malware via porsasystem[.]com.

Meanwhile, new ClickFix phishing kits use cache smuggling to deliver “invisible” payloads—no downloads needed.

How to spot & kill it ↓ https://thehackernews.com/2025/10/hackers-exploit-wordpress-themes-to.html

🚨 Hackers are hijacking WordPress sites right now.

A critical flaw (CVE-2025-5947) in the Service Finder theme lets anyone log in as an admin — no password needed.

13,800+ exploit attempts. Still rising.
Most sites haven’t patched.

Details here → https://thehackernews.com/2025/10/critical-exploit-lets-hackers-bypass.html

Preemptive Defense is the next frontier of identity security.

It can block AI-driven attacks before a user even authenticates — no login required.

Here’s how it works (and why Gartner’s calling it the new IAM essential).

Learn more ↓ https://thehackernews.com/expert-insights/2025/10/identity-and-ai-threats-developing.html

Russian hackers are now using AI to write malware.

Ukraine’s cybersecurity agency says over 3,000 cyberattacks hit in early 2025 — many powered by AI-generated phishing and data-stealing code.

One strain, WRECKSTEEL, was built with AI tools to target state networks.

Full report → https://thehackernews.com/2025/10/from-phishing-to-malware-ai-becomes.html

⚡ Latest ThreatsDay Bulletin Out Now!

Hackers exploit MS Teams + MFA to breach orgs — plus a $2B crypto heist, .LNK malware with PowerShell implants, Autodesk zero-days, and IoT hub exploits.

🔗 Your quick intel brief → https://thehackernews.com/2025/10/threatsday-bulletin-ms-teams-hack-mfa.html

🚨 One stolen token can bypass MFA.

Last year, a single unrotated API key let attackers compromise Cloudflare’s internal systems — even after a full credential reset.

OAuth & API tokens are the new backdoors hiding in plain sight.

How to spot them before attackers do ↓ https://thehackernews.com/2025/10/saas-breaches-start-with-tokens-what.html

🟥 SonicWall breach ALERT!

Hackers accessed cloud-stored firewall backups — about 5% of customers affected.

The files hold encrypted credentials and configs that could help attackers target devices.

Check your MySonicWall portal for impacted devices → https://thehackernews.com/2025/10/hackers-access-sonicwall-cloud-firewall.html

🚨 A new Android spyware is spreading like a worm.

“ClayRat” infects phones, then messages every contact to spread further.

It hides as WhatsApp, YouTube, or Google Photos — even faking Play Store screens.

Full analysis ↓ https://thehackernews.com/2025/10/new-clayrat-spyware-targets-android.html

A China-backed group just turned AI into a cyber weapon.

They’re using it to write phishing emails and build malware — across English, Chinese, and Japanese targets.

The result? A new backdoor called GOVERSHELL spreading via fake research invites.

Read how ↓ https://thehackernews.com/2025/10/from-healthkick-to-govershell-evolution.html

🚨 Google confirms dozens of organizations breached via Oracle E-Business Suite zero-day (CVE-2025-61882).

Attackers exploited the flaw since July 2025, using multi-stage Java implants and extortion tactics.

🔹 Oracle issued an emergency patch Oct 4
🔹 Exploit code is now public — risk rising

🔗 Details: https://thehackernews.com/2025/10/cl0p-linked-hackers-breach-dozens-of.html

🚨 Active zero-day alert: Gladinet’s CentreStack & TrioFox are under live exploitation.

Hackers are chaining two CVEs to pull machine keys and trigger remote code execution — no patch yet.

Admins, disable the temp handler now ↓ https://thehackernews.com/2025/10/from-lfi-to-rce-active-exploitation.html