ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Editor, HackWire
Andy Arevalo edits HackWire, tracking the cybersecurity stories that matter to defenders — active breaches, newly disclosed vulnerabilities, malware and ransomware campaigns, and the policy shifts shaping the field. Every HackWire brief is written to cut through the noise and give security professionals the decoded version fast, with a link back to the primary source.
HackWire is an independent publication. Coverage is sourced from established security outlets and primary research, then synthesized and fact-checked before publishing. See our editorial approach and source list.
GitLab CVE-2023-7028 (CVSS 10.0) enables unauthenticated account takeover. Patched Jan 2024 but unpatched widely; CISA confirms active exploitation exposing code, CI/CD creds, and secrets.
Lenovo's identity platform flaw compromised 5,000+ Dropbox accounts via OAuth hijacking. The breach reveals a fundamental vulnerability: cloud services implicitly trust identity providers, so their failures cascade to all linked accounts.
Pentagon disabled ad tracking on military devices after foreign adversaries exploited commercial location data to track troops. It exposes how ad networks' granular tracking infrastructure—built to target mattress ads—can be weaponized for surveillance.
Researchers confirm a China-aligned group is exploiting a critical flaw in Sogou Input Method (CVE-2026-51990) to deploy GrayRabbit backdoor. The vulnerability is especially dangerous because IMEs intercept all keystrokes with deep OS-level access, threatening hundreds of millions of users globally.
A 22-year-old stole $245M in crypto via social engineering, then recklessly documented his lavish spending. The victim's poor opsec—keeping $245M accessible—enabled the sophisticated targeted attack.
CRPx0 evolved from fraud to ransomware, showing how criminal groups upgrade tactics for better monetization. The skills and infrastructure built for scamming—evading detection, handling crypto, monetizing at scale—transfer directly to ransomware operations.