The Hacker News

⚠️ UPDATE: A tampered Ledger can leak your 24-word recovery phrase over LTE. Ledger says a hidden implant reads setup screens and transmits the phrase via eSIM—without modifying the Secure Element or OS. Affected users and losses remain unknown. Genuine Check may miss it. Read: https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html

🛑 Anthropic warns small AI models may be months away from self-replicating on IoT devices, potentially forming botnets that are hard to shut down. In tests, GLM-5.2 propagated Llama 3.1-8B to all 8 nodes in 4 of 5 trials. Read: https://thehackernews.com/2026/10/anthropic-warns-small-ai-models-could.html

⚠️ Docker Hub's critical GhostPat flaw let users publish images under someone else's name through account conversion. The bug lasted over two years. Docker fixed it and found no evidence of exploitation. Read: https://thehackernews.com/2026/10/docker-fixes-critical-two-year-old-hub.html

‼️ Three zero-days. Root commands. No login. An attacker exploited the flaws in a fully patched Ivanti Connect Secure VPN and stole stored credentials. Ivanti confirms exploitation in the wild. Two flaws patched; a fix for the third is pending. Read: https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html

🛑 New CVSS 10.0 flaw disclosed in SAP Cloud SDK for Python (CVE-2026-89111). It allows attackers to steal OAuth2 client IDs and secrets by manipulating tenant subdomains. 🛠️ Fix: Ensure you're running v0.55.1 or newer (latest is 0.58.4). Details: https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html