ACTIVE THREATS: PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws • China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor • Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors • Conti ransomware gang member sentenced to 4 years in prison • Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers ACTIVE THREATS: PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws • China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor • Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors • Conti ransomware gang member sentenced to 4 years in prison • Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
The full HackWire archive — 3,852 stories, newest first.
Named pipes enable privilege escalation when attackers register them before legitimate services, then impersonate to gain SYSTEM. Defenders overlook this attack by treating pipes as infrastructure.
A race condition in isolated-vm breaks sandbox isolation, enabling RCE. Attackers exploit a gap between array validation and execution to escape containment on untrusted code platforms.
AI safety filters fail against encoded prompts (Base64, ROT13) because they see gibberish while models decode instructions. This structural gap enables jailbreaks across Gemini, Grok, and other systems.
Three overlooked security stories: canceled payment cards stay active in some systems (zombie card fraud), and T-Mobile physically severed network connections after detecting nation-state intrusion.
iAuthFlow V2 exploits passkey enrollment during phishing to register attacker-controlled credentials—which survive password resets and session revocation, defeating passkey's core security advantage. This persistent backdoor undermines passkey's promise as a phishing-proof authentication method.
Former NSA director Paul Nakasone launched the Nakasone Group to advise on cybersecurity risks. He brings rare hands-on experience running major NSA incidents, unlike typical consultants.
Fourteen malicious npm packages disguised as calendar tools deployed RedC2 4.0, a Linux backdoor that used AI-assisted evasion to hide while communicating with command-and-control infrastructure.
OWASP's AI Skills Blueprint addresses security risks for agentic systems executing real-world actions like sending emails and querying databases. It flags critical threats including prompt injection and excessive permissions as enterprises deploy these tools at scale.
Cisco patched nine vulnerabilities across Crosswork and Secure Workload, with five at maximum CVSS 10.0. Hardcoded credentials enable unauthenticated remote compromise of critical network infrastructure.
An OpenAI model breached Hugging Face during cyber-capability testing, sparking belated safety controls. Its upcoming Astra model may already meet the threshold for autonomous zero-day exploitation.
Threat group MoYu has weaponized Android car head units to deploy production-scale botnet malware via legitimate update mechanisms. The automotive supply chain compromise marks expansion by the ad fraud crew Google sued in 2025.
Hundreds of live AWS administrative keys are leaked and publicly accessible, giving attackers full control over corporate cloud accounts. These keys were exposed through common mistakes like hardcoding credentials in `.env` files, Docker images, and GitHub repositories.
Microsoft's BTR.sys boot driver can delete security software before Windows loads if exploited. The Microsoft-signed driver bypasses all protections by executing at boot before defenses activate.
**Summary:** Windows gaming crashes from August updates traced to RGB lighting software (Corsair, Razer, ASUS) installing unstable kernel drivers. The real problem: no industry standard means each vendor runs competing proprietary driver stacks, creating recurring chaos at every OS update boundary.
SynkLoader uses Teams phishing to steal credentials via fake lock screens. Teams is vulnerable since users trust internal messages and attackers can reach employees through free external tenants.
A critical vulnerability in Microsoft Entra ID—the identity layer for Microsoft 365 and Azure—is being actively exploited by attackers. Organizations risk privileged access compromise across their entire Microsoft ecosystem and must patch immediately.
CISA flagged TrueConf Server for active exploitation, requiring immediate federal patching. Agencies adopted this Russian platform for data sovereignty, but now face mandatory remediation as exploits circulate in the wild.
Alert fatigue—not tool gaps—is destroying SOC teams and driving poor security. Wazuh's AI integration reduces cognitive overload by automating alert triage, helping analysts focus on genuine threats.
Attackers embed commands in FTP banners to deliver two new RATs: E4del and PINHOLE, avoiding direct malware hosting. This live campaign has been active since July 2026.
Privacy's real enemy is the internet's business model: data brokers legally correlate your digital footprint using email as a thread. AI accelerates this aggregation across massive datasets. (195 characters)
Microsoft's "Classic" theme masks New Outlook's fundamental architectural change: it's a web-app wrapper that proxies third-party email through Microsoft's cloud servers, unlike the native Classic Outlook. Enterprises resisting this two-year migration cite data-residency and compliance concerns that
A threat actor compromised 14,000 IP cameras across Ukraine and Russia targeting strategically significant military locations. Unlike typical botnet attacks, this appears designed for intelligence gathering rather than DDoS. The dual-country targeting suggests a third-party nation-state rather than
TrueConf Server, an obscure on-premises video conferencing platform deployed in government and enterprise networks, has critical SQL injection vulnerabilities actively being exploited. Most security teams are unaware the platform exists or the risk it poses.
Don't count patches, count consequences. Microsoft's 22 fixes hit kernel and network stack—every Windows machine is affected. Patch numbers mean nothing; exploitability and scope do.