The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The October 8, 2026, ThreatsDay roundup from The Hacker News brings together 15 separate cybersecurity stories—not one coordinated campaign. Among its clearest lessons: trust in extensions, packages, cookies and exposed services can become an attack path, while long-lived medical devices pose a distinct challenge for post-quantum planning.
What happened in the WhatsApp-linked RAT report?
Morphisec described a multistage Windows infection chain associated with a financial-document executable called “Statement.exe” that was reportedly sent through WhatsApp. The reported delivery channel does not mean WhatsApp itself was compromised. The chain ended in VulcanRAT207.A and included host screening, an attempted privilege increase, use of the signed GoFly64.sys driver to terminate selected security processes, DLL side-loading and a WebSocket remote-access trojan.
Abusing a signed but vulnerable driver to interfere with security tools is often called “bring your own vulnerable driver” (BYOVD). The technique illustrates why a valid software signature alone does not establish that a driver is safe to run.
How did the ransomware affiliate go rogue?
CloudSEK reported that Azazel, a Russian-speaking affiliate associated with the Gentlemen ransomware operation, published victim data on a separate leak site called Leakned and collected extortion proceeds outside the program. The report describes a dispute over control of the operation’s proceeds as well as harm to victims; it does not establish an overall victim count.
#1 Best Overall
What did Forescout find about post-quantum readiness in healthcare?
Forescout analyzed more than 2.5 million devices across more than 50 healthcare delivery organization networks. In those studied environments, it found SSH implementations capable of supporting post-quantum cryptography (PQC) on 6% of internet-connected medical (IoMT) devices, 16% of operational technology (OT) devices and 50% of IT devices. Forescout also reported that 31% of exposed healthcare systems in its analysis supported TLS 1.3. These are findings about its dataset, not a census of all hospitals.
The differences by device class matter: the equipment that is hardest to update may also have a long operational life. Forescout’s practical approach is to inventory devices and the sensitive data they handle, identify which assets can be upgraded, and prioritize migration according to exposure and data risk. An inventory and migration plan are not proof that every device can be upgraded.
What other attack techniques did the roundup cover?
Power BI phishing and remote-management tools
The roundup also covers a phishing report in which a Power BI lure delivered remote-monitoring and management (RMM) software. The available account does not specify the campaign’s target, scale or RMM product, so it should be read as an example of phishing used to deliver a tool that can also have legitimate administrative uses—not as evidence that Power BI itself was compromised.
A file-upload flaw used to enable web shells
Another report describes a software file-upload vulnerability that could enable web-shell placement. A web shell gives an attacker a way to interact with a compromised web server. The roundup does not provide enough detail here to identify the affected product or describe the precise exploit conditions.
Rank #3
Attacker staging material on an exposed service
ThreatMon reported that an exposed staging service associated with an intrusion linked to Viva Aerobus contained 17 named post-exploitation tools and traces of activity. The initial access method was unclear in the roundup’s account; after access, the attacker reportedly used Microsoft SQL Server’s xp_cmdshell. The exposed service and the reported intrusion should not be treated as proof that the initial compromise began through that service.
Cookie construction that enabled impersonation
Resecurity reported flaws in an unnamed yard-management system: a hard-coded signing secret identical to the cookie name, combined with a public database identifier used in place of a random session identifier. According to Resecurity, users’ cookies could be forged when their identifiers were accessible through the API. The roundup does not name the vendor, so the finding should not be generalized to other yard-management products.
Why are developer extensions and packages a security concern?
The roundup covers malicious Visual Studio Code themes as well as compromised packages in npm and RubyGems. These are separate points of exposure: an extension may reach a developer’s workstation, while a package can enter a project’s dependencies or build environment. Either route can put developer machines or continuous-integration environments at risk. Package names, versions and indicators are time-sensitive; the roundup does not establish that every installation or version in either ecosystem was affected.
Socket researcher Kirill Boychenko was quoted in The Hacker News as saying: “That build contains the same Solana address, AES key, and execution model previously documented in GlassWorm activity.” That comparison is specific to the build Boychenko discussed; it does not make all the extension and package reports part of one campaign.
Best Value
What did the roundup say about AI privacy?
The roundup included a privacy concern about Meta’s Muse assistant and the information it may remember. Meta’s response, as reproduced by The Hacker News, was: “Muse remembers what matters most to you, including information about others that you choose to share, so it can be a helpful personal assistant.” That is Meta’s description of the feature, not an independent assessment of how a particular user’s information is handled. Readers should consult the applicable product settings and privacy terms before sharing sensitive information.
What was the outcome of the insider-sabotage case?
The U.S. Department of Justice reported that former employee Daniel Rhyne was sentenced to 32 months in prison for a computer attack and extortion attempt against his former employer. The roundup says the sentence followed a guilty plea. This is a reported criminal case outcome, distinct from the allegations in the other stories.
What did the roundup report about scam-center enforcement?
The bulletin also covered Operation Blackout and a reported $17 billion figure relayed through Fox News as a statement by FBI Director Kash Patel. The material does not establish that amount as an independently verified or audited seizure total, so it should not be read as one. Patel was also quoted as saying, “There is no safe haven for criminals targeting Americans.”
What connects these otherwise separate reports?
The useful editorial thread is trust and control—not a shared actor. A malicious extension or package can exploit the trust developers place in their tools; weak session design can undermine account boundaries; a vulnerable driver can help malware evade defenses; and an exposed service can reveal an intruder’s tools. Healthcare PQC planning raises a different but related control problem: organizations need to know which devices they have and what can realistically be changed. Each finding remains attributable to its own reporting source.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
