ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Weekly cyberattacks on Africa fell 22% year-over-year as threat actors pivot toward Latin America, signaling a geographic shift in the global threat landscape. While African organizations gain temporary relief, the rebalancing raises urgent questions about preparedness in emerging attack targets.
Zealot, an AI attack framework, executes cloud attacks in minutes vs. human response hours. Its adaptive decision-making outpaces traditional automated tools, revealing a critical speed gap.
Chinese state-aligned hackers route attacks through compromised consumer devices to obscure origins, complicating detection and attribution. This proxy-network escalation represents a significant shift in cyber tradecraft that undermines Western deterrence efforts.
A Microsoft Edge update broke Teams meeting access for Windows users, affecting thousands of organizations. Microsoft acknowledged the issue and provided workarounds pending a permanent fix.
Apple fixed a critical iOS flaw that exposed deleted Signal messages via notification caches. Physical attackers could recover supposedly-deleted data from device forensics. Install the patch immediately.
Anthropic withheld an AI vulnerability-finder from public release, partnering with Apple, Microsoft, and others instead. The approach balances defensive innovation against weaponization risks.
AI is automating vulnerability exploitation at machine speed, collapsing the response window from weeks to minutes. This eliminates traditional patch timelines and forces organizations to abandon reactive defense models in favor of continuous, real-time protection.
CISA mandated federal agencies patch BlueHammer, a privilege escalation vulnerability in Microsoft Defender actively exploited in zero-day attacks. The flaw allows attackers to escalate from standard user to SYSTEM-level access, enabling malware installation and persistent network compromise.
State-backed APT GopherWhisper targets governments with a Go-based toolkit, abusing Outlook, Slack, and Discord for covert command-and-control. The group evades detection by blending malicious traffic into legitimate enterprise communications.
Apple patched an iOS flaw allowing recovery of deleted chat messages across multiple devices due to improper data sanitization. The vulnerability highlights a persistent challenge in ensuring deleted data is truly removed from mobile storage.
Apple patched CVE-2026-28950, an iOS flaw retaining deleted Signal notifications for forensic recovery. Users believed these messages were permanently removed, but examiners could still access them.
Vercel expanded its breach investigation and found more compromised customer accounts than initially reported. The incident involved unauthorized access to internal systems connected to Context.ai, affecting additional customers without disclosing exact numbers.
China-linked GopherWhisper APT compromised 12+ Mongolian government systems using Go-based backdoors. The multi-stage attack demonstrates growing threats to Central Asian infrastructure.
Critical zero-day in Microsoft Defender enables attackers to extract credential hashes and escalate to System-level access on Windows, actively exploited in targeted attacks globally.
Apple patched a critical Notification Services flaw that exposed deleted Signal messages. Dismissed notifications persisted on device storage instead of being deleted, allowing potential forensic recovery of encrypted communications.
A school safety company claiming 20+ years without breaches was hacked, serving 35,000 schools' anonymous tip lines for reporting bullying and threats. The breach undermines trust in a system critical for early intervention on student safety issues.
The Gentlemen ransomware gang has compressed years of typical growth into months, targeting high-value organizations across sectors with six-figure demands and multiple attacks per week. This newly emerged group demonstrates concerning technical sophistication and operational speed despite increased
Apple released emergency patches for a critical iOS flaw that left deleted notifications recoverable on devices, exposing 2FA codes, banking alerts, and private messages to physical attackers.
Attackers compromised the Checkmarx KICS Docker repository and VS Code extensions, injecting malicious code into v2.1.20 and alpine tags and creating a fake v2.1.21 release to target Infrastructure as Code developers globally.
Kyber ransomware gang deploys post-quantum encryption (Kyber1024) targeting Windows and VMware ESXi, marking significant technical escalation. This quantum-resistant approach raises urgent questions about enterprise readiness for quantum-era security threats.
A Mirai botnet is actively exploiting CVE-2025-29635, a critical flaw in discontinued D-Link routers, to recruit thousands of devices for DDoS attacks. Millions of unpatched end-of-life routers remain at risk, with infection rates accelerating as mass scanning continues.
SBOMs provide visibility but security teams struggle to act on data due to volume and false positives. The missing link is governance-driven intelligence to convert raw data into actionable decisions.
Mirai botnet is actively exploiting a year-old D-Link router vulnerability, targeting discontinued devices vulnerable despite public disclosure. The resurgence shows how legacy, unmaintained hardware remains attractive to botnet operators long after flaws are revealed.
Harvester deployed a Linux GoGra backdoor abusing Microsoft Graph API for C2 against South Asian infrastructure. It evades detection by hiding attacks in legitimate cloud services.