The Hacker News

‼️ 14 npm packages drop RedC2 4.0 on Linux. The packages work as advertised, but also launch its RedShell beacon on import. RedC2 includes an LLM-backed agent that turns natural-language instructions into beacon commands. Read - https://thehackernews.com/2026/08/14-trojanized-npm-packages-drop-redc2.html

‼️ Attackers can weaponize Defender’s own signed driver to delete security software at boot. BTR.sys runs from Ring 0 before Defender’s user-mode services start. Check Point showed it deleting the full Defender stack on Windows 11 25H2 with Tamper Protection enabled. See how it works: https://thehackernews.com/2026/08/microsoft-defenders-own-driver-can-be.html

⚠️ Android car head units are getting malware through built-in updaters. Attackers abused DoFun’s update channel to deliver malware for ad fraud and proxy botnet activity. It can also download and run arbitrary code. Full details: https://thehackernews.com/2026/08/android-car-malware-spreads-through.html

Wazuh now uses Claude to automate scheduled SOC reports. Wazuh AI Analyst processes cloud security data through Amazon Bedrock and Claude, then reports on alerts, protected endpoints, active vulnerabilities, and security posture. Teams can also plug Wazuh into self-hosted Llama 3 or Claude 3.5 Haiku. See how it works: https://thehackernews.com/2026/08/wazuh-and-ai-for-enhanced-soc-workflows.html

‼️ Five CVSS 10.0 flaws affect Cisco Crosswork and Secure Workload. They’re among nine vulnerabilities Cisco patched, covering SQL injection, missing authentication, access control, path traversal, and other security failures. Read: https://thehackernews.com/2026/08/cisco-patches-nine-crosswork-and-secure.html