ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Microsoft released a permanent fix for persistent Windows 11 crashes caused by kernel memory management and GPU driver conflicts affecting gamers and workstations alike. The delayed solution, preceded by temporary workarounds, underscores a growing trust deficit in Microsoft's update reliability pip
Australian police arrested two individuals tied to TeamPCP, which allegedly compromised developer tools and repositories to inject malware into software before distribution. This supply-chain attack could automatically propagate malicious code to thousands of downstream systems, making it particular
Android 17 adds Encrypted Client Hello to hide website names by encrypting the domain name in the TLS handshake. OS-level support protects all app traffic, finally closing the gap that left Server Name Indication exposed to ISPs and governments.
Threat research gives security teams insight into how attackers operate, while MDR turns that intelligence into faster detection and response. ESET explains how combining threat intelligence, continuous monitoring, and human expertise can help SMBs strengthen their defenses. [...]
Citrix NetScaler faces renewed active exploitation. As the critical edge appliance controlling enterprise authentication and remote access, it remains a repeat target—with 80,000+ instances publicly exposed—and the industry follows the same patch-and-repeat cycle.
Of 405 AI-linked malware samples studied, only 12 reached production systems; 393 died as proof-of-concepts, red-team tests, or fake AI installers. The threat is real but far less catastrophic than headlines suggest.
Qilin ransomware hit the ATF in August—the third federal agency breach in 2026 after FBI (March) and DHS (July). Federal agencies' security apparently lags mid-market companies.
Avada theme (900k+ sales) contains a critical zero-click RCE flaw. Unauthenticated attackers can execute remote code via HTTP requests, bypassing all traditional defenses like MFA.
**Summary:** Interpol's Operation Jackal IV targets West African cybercrime infrastructure rather than individuals, recognizing Black Axe as a criminal platform enabling fraud-as-a-service at scale.
NovaCookies is a $320/month phishing-as-a-service proxy that defeats MFA by intercepting Microsoft 365 logins. It captures the authenticated session cookie after victims complete MFA, giving attackers valid tokens to access accounts.
North Korean operatives infiltrate companies as fake remote IT workers, funneling salaries to weapons programs. With improving identities, they serve as both financial and espionage operations.
Lebanon-linked espionage group Dark Caracal is upgrading to GoCaracal, a new Go-based modular malware framework, marking their evolution from high-volume commodity tools to more sophisticated surveillance operations.
CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, including Citrix NetScaler flaws that have remained unpatched for years despite active exploitation. The update exposes widespread enterprise vulnerability management failures, revealing that organizations routinely ignor
JarService malware infects car head units via firmware updates, turning them into click-fraud proxy botnets undetectably. The attack weaponizes the very mechanism designed to keep devices secure.
SharePoint Server has a publicly disclosed RCE exploit chain enabling unauthenticated code execution. With PoC code public, organizations face imminent risk as commodity actors weaponize the technique.
Meta pays $18B to settle teen mental health harm claims. The settlement's real significance: it creates a legal record proving Meta knowingly deployed addictive features despite internal warnings.
CISA's red team simultaneously compromised two critical infrastructure organizations using identical attacks; only one detected the breach, exposing a dangerous gap between assumed and actual security capabilities.
Nimbus Manticore, an IRGC-linked Iranian APT group, is becoming stealthier with new backdoors and SSH tunnelers designed for persistence rather than dramatic attacks—signaling growing operational maturity.
FBI disrupted QScan and QTRouter, Chinese tools used to map U.S. infrastructure networks. The platforms reveal Beijing's outsourcing model—hiring private contractors for state cyberattacks.
Boston Scientific's cyberattack disrupted pacemaker manufacturing globally. Unlike typical corporate breaches, this threatens production of implantable devices critical to patient survival.
GPUThor breaks NVIDIA's ECC GPU protection via Rowhammer attacks, enabling root-level privilege escalation. This shatters the security assumptions that protected shared GPU datacenters.
NovaCookies exploits legitimate Docusign emails and Microsoft OAuth proxies to harvest credentials and MFA codes. This phishing kit, costing $320/month, targets hundreds of organizations undetected.
Snowflake is killing password authentication for service accounts by autumn 2026 after credential theft compromised 165 customers and billions of records, targeting old, undocumented accounts most at risk.
FBI shut down a Chinese espionage quartermaster renting hacking tools. Intelligence agencies rented modular platforms for reconnaissance and relay networks instead of building their own.