ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity breaches news, analysis, and intelligence.
OpenAI pledged $1 billion for "Daybreak," offering subsidized AI access to critical infrastructure defenders against state-sponsored hackers. However, the announcement lacks specifics on costs, eligibility, and terms, leaving the program's actual value beyond the headline number unclear.
Three understated security stories expose uncomfortable industry truths: Microsoft patches cloud vulnerabilities without disclosing details, preventing customers from hunting compromises; 5,000 Dropbox breaches reveal how interconnected data compounds risk; and a billion-dollar browser-security star
ShinyHunters claims a ReliaQuest breach, backed by prior breaches (Snowflake, AT&T, Ticketmaster). If confirmed, it exposes enterprise security logs and incident data—nightmare for MDR vendors.
Threat intelligence experts converge on a six-month timeline before autonomous AI-assisted attacks become standard in adversary playbooks. Unlike traditional automation, these "agentic" systems reason and adapt through reconnaissance-to-exfiltration attack chains, collapsing the operator constraint
IDScan's breach exposed 153 million driver's licenses to hackers. Most victims had no idea the age-verification vendor existed, sparking lawsuits over mandatory disclosure of personal ID data that can't be cancelled and fuels identity theft for years.
Though FIDO2 cryptography is sound, 39 attack methods exploit the surrounding ecosystem—enrollment, recovery, and synced credentials—rather than the crypto itself. The passkey's security depends less on unbreakable math than on imperfect systems and human processes around it.
FBI probed a service selling access to 153M driver's licenses. This on-demand lookup posed a greater threat than traditional breaches, enabling identity theft, fraud, and targeting.
BraZetsu automates the entire credential-theft-to-marketplace pipeline, packaging stolen browser data, credentials, and device fingerprints into ready-to-sell digital identities that bypass MFA. It removes manual operator work from the process, industrializing underground criminal commerce.
Thomson Reuters' C-Track court platform was breached in March 2026, exposing sealed records, SSNs, and sensitive case data across 11 U.S. states. The intrusion went undetected for three months.
The biggest security threat isn't dramatic breaches but normal-looking phishing attacks. Commodified phishing kits now target executives at scale, making social engineering economics favor attackers.
A French hospital received a €500,000 fine for inadequate security that led to a 727,000-patient data breach, signaling stricter European enforcement of healthcare data protection compliance.
Coder's Cloudflare infrastructure was hijacked to redirect Terraform modules to malicious servers. These modules stole cloud credentials since Terraform executes with access to AWS/GCP/Azure keys.
Plex urged immediate security updates across media servers and desktop clients due to multiple vulnerabilities. With 20 million devices often exposed to the internet and users slow to patch, vulnerable instances persist for months.
Infostealer logs contain authenticated session cookies—not just passwords—allowing attackers to hijack active sessions and completely bypass MFA. Because discovery typically lags days or weeks, attackers likely already moved laterally and established persistence before the breach was detected.
BGP hijackers poisoned Virtualizor updates to install root backdoors on hosting hypervisors. The attack weaponized internet routing trust assumptions to compromise infrastructure through software updates.
A Russian hacker compromised 80,000 freelancers via TVRAT/DarkVNC malware to infiltrate their client networks. Freelancers are ideal attack vectors—they work across multiple organizations without corporate security controls, making them structural weak links in enterprise defense.
Novocure breach exposed 1,400+ cancer patients' medical records and insurance data. Medical information is highly valued on criminal markets for identity theft, fraud, and extortion schemes.
Aesto Health's 9.5M patient breach exposes the third-party problem: vendors aggregate data across multiple health systems, creating single points of failure patients never consented to.
Iranian hackers pose as recruiters, tricking developers into downloading malware disguised as coding tests. Nimbus Manticore's Node.js/JavaScript RAT exploits trust in the hiring process and works cross-platform on Windows, Linux, and macOS.
The perimeter didn't fail—trust did. This week's threats weaponized supply-chain compromise: pre-backdoored routers, proxy exploits, and insider attacks that persist for years, survive resets, and evade detection.
Fire Ant embedded hidden GRE tunnels in Cisco routers for covert command channels that bypass audit logs and configuration histories, exploiting gaps in IOS XR forensic mechanisms. The technique creates persistent, encrypted exfiltration channels invisible to standard security monitoring.
FulcrumSec stole 86GB from Manchester Airports Group; verified passenger records confirm the breach is real. Travel data—names, passports, itineraries—creates permanent fraud and identity risks for millions of passengers.
GTA 6 hacker CYBERLEEK skipped ransom, launching a crypto token to monetize the leak instead. It's an "influencer model"—profiting from audience attention rather than extorting the victim.
TeamPCP's supply chain attack via self-replicating malware breached 1,000+ orgs and stole 500K credentials. OpenAI's compromise shows AI platforms are now prime targets for sophisticated threats.
Hasbro exposed employee personal data in a cyberattack disclosed months later. Employee SSNs and compensation records enable phishing and fraud, exemplifying typical corporate breach notification delays.
Years after Log4Shell, Log4j RCEs resurface in production because the library was embedded across vendor software. Poor supply chain visibility means security patches remain incomplete—vulnerabilities keep resurfacing in overlooked places.
Qilin ransomware breached the ATF in August but unusually hasn't revealed what was stolen. ATF won't clarify what sensitive data on firearms or trafficking Qilin may have accessed.
OT systems lack logging and detection by design, rendering attacks on critical infrastructure nearly invisible. Defenders must therefore rely on deception rather than evidence to identify attackers—a fundamental architectural gap exposed by Ukraine 2015 and Colonial Pipeline 2021.
Berlin refused ransom after attackers compromised its state network and exfiltrated data before demanding payment. The approach reflects modern ransomware tactics: establish access, steal over time, then extort.
ShinyHunters claims it stole 284M McKesson patient records; McKesson only confirms third-party app access. Whether it's a catastrophic breach or inflated ransom threat, the incident exposes dangerous vulnerabilities in healthcare's interconnected data infrastructure.