ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
A self-propagating npm worm called CanisterSprawl steals developer tokens to autonomously spread malicious code across packages. It uses blockchain infrastructure for command-and-control, demonstrating a new escalation in supply chain attacks targeting the Node.js ecosystem.
Lotus Wiper targets Venezuela's power grid, permanently destroying data and recovery mechanisms. Resembling state-sponsored variants, it marks escalation in destructive cyberattacks on critical infrastructure.
Mastodon suffered a major DDoS attack disrupting the federated network, days after Bluesky faced similar attacks. The incidents raise concerns about decentralized platforms' security resilience.
North Korean threat actors distribute malware via fake developer job interviews. The self-propagating malware spreads through victims' source code repositories, creating cascading infections across development teams and infrastructure.
"Caller-as-a-Service" fraud platforms industrialize scams by letting criminals rent access to trained callers and infrastructure, transforming fraud into a professional, scalable operation that mirrors legitimate call centers—complete with hiring, training, performance metrics, and quality assurance
Spain dismantled the largest Spanish-language manga piracy site operating since 2014, arresting four people and seizing $4.7M in assets. The platform served millions of users globally for over a decade before this coordinated law enforcement takedown.
UK faces escalating state-sponsored cyber threats from Russia, Iran, and China targeting critical infrastructure. Officials warn of potential coordinated large-scale attacks if the nation becomes militarily involved internationally.
Google patched a critical prompt-injection RCE vulnerability in Antigravity that allowed attackers to bypass sandbox restrictions and execute arbitrary code. The flaw underscores emerging security challenges in agentic AI systems with filesystem access.
Microsoft patched CVE-2026-40372, a critical ASP.NET Core privilege escalation (CVSS 9.1) from flawed signature verification. The network-based attack requires no authentication, letting attackers bypass privilege checks and gain elevated system permissions.
A self-replicating npm attack publishes malware through compromised accounts, stealing authentication tokens. It has affected popular packages, potentially exposing millions of downstream users.
Moltbook's January 2026 breach exposed 1.5M API tokens and plaintext OpenAI/Anthropic credentials stored in agent message archives, enabling attackers to impersonate agents and abuse APIs across interconnected platforms. This reveals critical systemic risk in how AI agent ecosystems handle credentia
Lotus Wiper is destructive malware discovered by Kaspersky targeting Venezuela's energy sector. Using batch scripts to erase data, it reflects escalating cyberattacks on critical infrastructure.
A Linux GoGra backdoor variant exploits Microsoft Graph API to access Outlook inboxes as a covert C2 channel. It enables stealthy command delivery while evading network detection.
A Graph API code change disabled printer share creation in Universal Print. The outage affects multiple organizations, blocking print infrastructure management across Microsoft 365 environments.
Microsoft is rolling out Efficiency Mode for Teams on Windows to reduce CPU and memory consumption, targeting organizations with aging hardware where the app historically consumes 2-4GB of RAM.
Oracle patched 481 vulnerabilities across 28 product families in its April 2026 CPU. Over 300 are remotely exploitable without authentication, creating significant risk for organizations with internet-facing Oracle systems.
Cohere's Terrarium sandbox (CVE-2026-5752, CVSS 9.3) allows remote root code execution via JavaScript prototype chain manipulation. Attackers need only submit code to escape the sandbox entirely, endangering AI pipelines and code execution services relying on it.
Mustang Panda deployed a LOTUSLITE backdoor targeting Indian banks and South Korean officials. The malware enables persistent remote access via dynamic DNS C2 for intelligence gathering.
Microsoft patched a critical ASP.NET Core privilege escalation (CVSS 9.8) allowing unauthenticated attackers to execute arbitrary code without user interaction. Organizations running ASP.NET Core must apply patches immediately.
1,300+ unpatched SharePoint servers face active spoofing attacks enabling user impersonation and unauthorized access. Despite high severity, servers remain exposed months after public disclosure, highlighting persistent enterprise patch management failures.
A certificate validation flaw in Siemens Analytics Toolkit (CVE-2025-40745) enables unauthenticated MITM attacks on 7 products. Though rated CVSS 3.7, it threatens data integrity in manufacturing, aerospace, and energy sectors.
A ransomware negotiator pleaded guilty to collaborating with the BlackCat gang, exposing a critical flaw: one person controlled both ransom negotiations and payment mechanisms, enabling insider complicity. The case highlights why separating these operational duties is essential to prevent compromise
France Titres confirmed a breach after hackers auctioned stolen citizen data on dark web markets. Millions of citizens' sensitive administrative records were compromised, increasing fraud and exploitation risks.
SenseLive X3050 industrial devices contain critical authentication flaws enabling complete system takeover via multiple bypass vectors. Deployed across critical infrastructure globally, the unpatched devices lack proper credential validation and session management, with the vendor unresponsive to re