ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances ACTIVE THREATS: Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers • AI-powered attack exploited PaperCut flaws to hack 395 organizations • Microsoft Excel KB5002914 update breaks copy and paste for some users • Surfshark VPN says hackers breached internal testing, proxy servers • PaperCut Attacker Uses Hundreds of AI Agents to Compromise 440+ Instances
The full HackWire archive — 3,847 stories, newest first.
**Three threat groups (ransomware operators and nation-state actors) are actively exploiting two Cisco Firewall Management Center vulnerabilities. FMC is the management plane controlling all firewall policies; compromising it grants attackers complete visibility and control over an organization's en
A Russian-linked threat actor deployed hundreds of AI agents to exploit PaperCut NG/MF print management software across 395+ organizations in a methodical, automated campaign. This marks a watershed moment where AI automates sophisticated cyberattacks at global scale, targeting unpatched systems in
Microsoft's KB5002914 patch broke Excel's core functions (copy-paste and formula dragging), forcing users to uninstall the security update entirely. This teaches enterprises that patches cause more harm than protection, creating a security crisis bigger than any original vulnerability.
Surfshark revealed hackers breached an exposed test server due to misconfiguration. For a VPN company selling security trust, the incident chips away at their core value proposition, though user tunnels appear uncompromised.
Hundreds of AI agents compromised 440+ PaperCut servers in the first documented campaign where agentic AI was the primary attack vector—a fundamental shift in coordinated exploitation. This represents the first large-scale exploitation operation where autonomous agents, not humans, drove identificat
Gigabud banking trojan abuses Android's work profile feature to hide fraudulent banking apps in a sandbox invisible to security tools. The exploit weaponizes an enterprise isolation mechanism designed to separate work and personal data.
Two critical VPN flaws (9.8 CVSS) in Check Point require no authentication; one targets management servers, enabling network-wide policy manipulation. Check Point's vague disclosure of "specific conditions" obscures key exploitation details.
Microsoft's recent updates accidentally wiped desktop settings like wallpaper and icon layouts on affected Windows devices with no warning—the fix shipped in September's Patch Tuesday as part of the standard cumulative update bundle.
Ransomware gangs are exploiting a critical WatchGuard firewall vulnerability CISA flagged months ago, gaining full network control. Unpatched organizations face silent reconnaissance before encryption attacks begin.
KB5120998, a Windows 11 preview update, silently reset mouse settings on affected systems. The fix arrived in September's patch three weeks later, further eroding user trust in Microsoft's update pipeline.
Skullcandy Dime 3 earbuds accept Bluetooth pairing from any device without user confirmation. This "just works" vulnerability lets attackers silently intercept audio or inject content.
**ShinyHunters breached AdaptHealth, exposing 4.1M patients' medical records with diagnoses and SSNs. The database is valuable because it tracks chronic-disease patients covered by Medicare and Medicaid, giving attackers detailed health profiles and insurance information.**
Cisco FMC has a critical authentication bypass (CVE-2026-20079, CVSS 10.0) being actively exploited. Remote attackers can modify firewall policies across networks without credentials.
Attackers breached Trezor's email vendor and stole customer contacts for phishing campaigns. They target seed phrases—the critical vulnerability in hardware wallet security.
Four separate nation-state spy groups deployed the identical Chrome-to-Windows exploit chain within days, raising questions about whether this reflects parallel discovery or shared exploit broker distribution among intelligence operations.
DeepSeek Harness has a critical flaw: sandboxed AI agents can disable their own sandbox with a single command. It's an architectural permissions boundary failure, not a technical exploit—the harness exposed sandbox management controls to the agent without authorization.
Session tokens harvested by infostealers bypass MFA on AI platforms. Tokens issued post-authentication can be replayed without MFA, granting access to conversations, documents, and API keys.
The DOJ seized $52.8M and dismantled Xinbi Guarantee, a Telegram marketplace where scammers bought money laundering and stolen data. The operation exposes how fraud has become professionalized and platform-native.
Veradigm's ransomware breach exposed how patient data flows through hidden third-party vendors, creating risks patients never consented to. When vendors get compromised, the breach cascades to healthcare companies and the patients whose records they hold.
Six Chinese AI companies extracted billions of tokens from American frontier models through commercial API access, using model distillation to systematically build competing systems at industrial scale without authorization.
When CVEs drop, enterprises face a two-hour exposure race—but finding vulnerable code across fragmented tools is harder than patching. Unified visibility across scanners and assets is the critical gap.
An Ohio man got 15 years for AI sextortion—a landmark sentence. AI removed barriers to this crime: attackers need only public photos to create fake explicit material for blackmail.
36,000+ unpatched Plex Media Servers are publicly exposed and vulnerable to remote code execution and authentication bypass. Self-hosting users rarely maintain security updates, creating widespread home network security risks.
Account recovery is MFA's blind spot. Attackers impersonate employees to help desks, providing scraped PII to request credential resets and bypass MFA—a tactic that cost MGM over $100M.