ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
Latest cybersecurity breaches news, analysis, and intelligence.
Multiple US healthcare breaches documented in HHS tracker expose millions of patients' medical and financial data across hospital systems. Healthcare infrastructure faces escalating cyberattacks due to inadequate security practices, with patient data commanding premium prices on the dark web.
Phishing initiates 96% of breaches, but organizations often don't detect compromise for weeks—giving attackers time to move laterally and steal credentials. Early detection systems close this critical gap between attack and discovery, preventing adversaries from consolidating access while security t
Attackers now harvest developer credentials instead of injecting code directly. Recent npm, PyPI, and Docker Hub campaigns show developers' machines are supply chains' primary vulnerability.
Grafana Labs confirmed a breach after Coinbase Cartel leaked them on their extortion site. Attackers exploited a compromised authentication token to steal source code from GitHub, though customer data remained unaffected. Grafana refused the ransom demand.
Pwn2Own Berlin 2026 paid $1.3M for 47 vulnerabilities in enterprise and AI software, with record demand filling all slots before the event. Devcore led with exploits in Microsoft Exchange and Edge.
Grafana's GitHub token was compromised, exposing its source code and triggering an extortion demand. No customer data was affected, but the breach highlights critical risks of unprotected developer credentials.
OpenAI was compromised via a TanStack supply chain attack, losing sensitive credentials from two employee devices. The incident highlights how even major tech companies remain vulnerable to infrastructure-level threats.
A Taiwan teen spoofed emergency radio alerts using consumer equipment, triggering stops on three high-speed trains. The attack exposed critical vulnerabilities in THSR's authentication protocols.
Avada Builder plugin flaws expose database credentials and sensitive data on 1M+ WordPress sites, allowing attackers to achieve complete site takeover.
**node-ipc npm package (690K weekly downloads) compromised with credential-stealing malware in three versions.** The attack automatically exfiltrates developer credentials via obfuscated DNS TXT queries, with no persistence mechanism—suggesting rapid theft was the sole objective.
Nvidia's GeForce NOW breach exposed millions via a regional partner, highlighting supply chain risks. Modern threats exploit interconnected cloud infrastructure faster than defenders can contain them.
REMUS has transformed into a commercial malware-as-a-service platform offering 24/7 support and ~90% callback rates, representing a shift toward legitimate-seeming cybercrime operations. The infostealer's rapid evolution signals a more resilient threat landscape where barriers to large-scale credent
Two OpenAI devices fell victim to a TanStack supply chain attack, exposing internal source code and credentials but no user data. The company revoked affected signing certificates, requiring macOS users to update ChatGPT Desktop and related apps before the old certificates are blocked on June 12.
TeamPCP is auctioning 450 stolen Mistral AI code repositories for $25,000, threatening public release if no buyer emerges within a week. The breach highlights vulnerabilities in AI supply chains and the lucrative market for proprietary training data.
OpenAI's devices were breached in the TanStack supply chain attack, affecting hundreds of npm and PyPI packages. The company rotated code-signing certificates, illustrating that even major tech firms face supply chain risks.
Ghostwriter targets Ukraine's government with geofenced spear-phishing PDFs that only activate for Ukrainian IPs, deploying PicassoLoader for reconnaissance and Cobalt Strike Beacon for exploitation.
AI hallucinations generate confident false intelligence that security teams act on without verification, creating operational threats. A 2025 benchmark found most AI models more likely to be confidently wrong than right—turning trusted AI tools into critical security vulnerabilities.
KongTuke impersonates IT on Teams to trick employees into running malicious PowerShell commands in under five minutes. They rotate Microsoft 365 tenants to avoid detection.
ShinyHunters' Canvas LMS breach hit 9,000 institutions and 30 million students during finals season—history's largest educational compromise. Attackers exploited unpatched secondary access despite remediation efforts.
Canvas experienced a service outage and data breach affecting millions of students. The House Committee on Homeland Security is demanding answers, treating educational tech infrastructure as a critical national security concern.
Nitrogen ransomware stole 8TB of confidential data from Foxconn, compromising Apple, Intel, Google, and other major tech clients. The breach included sensitive product designs and internal communications, posted on the darknet in March 2026.
MuddyWater (Iran-linked APT) compromised 9+ targets including South Korean electronics firms. The sophisticated campaign targeted industrial and government secrets using legitimate tools for intelligence gathering.
West Pharmaceutical Services suffered a cyberattack on May 4, 2026, with data exfiltration and system encryption. Manufacturing remains disrupted with no recovery timeline provided.
The Gentlemen ransomware gang was breached, exposing 16GB of malware code and communications for $10K. The gang hit 332 organizations in 2026, making them the second-most prolific operation worldwide.
Two threat groups use AI to automate cyberattacks on Latin American governments and banks. They generate custom hacking tools and social engineering tailored to each target in real-time.
Attackers are chaining small vulnerabilities across code, pipelines, and cloud infrastructure to bypass security tools. Alert fatigue leaves teams unable to spot these "lethal chains" connecting low-risk issues into critical threats.
Sophisticated cyberattacks now assume they'll breach networks, making prevention alone obsolete. Organizations must adopt integrated cyber resilience—combining defense, detection, backup, and rapid recovery—to survive inevitable breaches.
Anthropic's Mythos AI found thousands of exploits in weeks; real-world attacks already compromise thousands of devices in minutes using known bugs. Human patching cannot keep pace.
Security teams close remediation tickets without verifying fixes actually work. With exploits now preceding patches, confirming remediation effectiveness—not just deployment speed—is critical.
Alert fatigue blinds teams to real threats. Attackers exploit this by chaining minor vulnerabilities across code and infrastructure into "lethal chains"—attack paths isolated AppSec tools miss.