ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
A British member of Scattered Spider pleaded guilty to cryptocurrency theft, marking law enforcement progress against the sophisticated social engineering group responsible for hundreds of millions in losses. Scattered Spider specializes in human manipulation rather than technical exploits, infiltra
** Researchers disclosed a design-level flaw in Anthropic's Model Context Protocol that enables remote code execution via malicious or poisoned MCP servers, threatening the broader AI supply chain. Sa
AI demos dazzle with curated data and perfect prompts, but deployments stall when they hit production's messy reality—duplicate data, unpredictable volumes, and legacy system friction. The AI works; operational friction doesn't.
Microsoft rolled back a faulty service update that disabled Teams for enterprises, causing widespread launch failures and authentication errors. The company identified and restored service within 48 hours after impact to thousands of organizations during peak business hours.
Microsoft is boosting File Explorer performance in Windows 11 through Insider testing, focusing on faster launch times and smoother file operations before wider release. The updates address responsiveness during navigation, reduce resource consumption, and improve handling of large directories and n
Microsoft released emergency patches for critical Windows Server vulnerabilities (2016–2025) enabling remote code execution and privilege escalation without user interaction. Organizations should prioritize deployment despite the out-of-band timing, as the critical severity warrants rapid remediatio
Despite a year-long exploitation campaign against TP-Link routers, attackers failed to achieve payload execution in the wild, revealing the significant gap between theoretical vulnerability and practical attack success. The research underscores how technical barriers can prevent weaponization even w
Vercel confirmed a security breach after ShinyHunters demanded $2M for stolen data, affecting thousands of organizations relying on the platform. The incident highlights how even well-resourced SaaS providers serving as critical development infrastructure remain vulnerable to determined threat actor
ZionSiphon malware targets Israeli water infrastructure with advanced persistence and lateral movement capabilities. The OT-specific threat poses risks to critical water supplies.
Vercel was breached through Context.ai, a third-party AI tool that exposed an employee's credentials, which attackers used to access internal systems. The incident highlights supply chain risks from integrating unvetted AI tools into enterprise workflows without proper security assessment.
Attackers weaponize Apple's own notification system by triggering account changes, then embedding phishing links in the resulting emails from Apple's servers. These fraudulent iPhone purchase alerts bypass security filters since they originate from legitimate Apple infrastructure.
Vercel confirmed a breach with credentials, API tokens, and source code being sold. As core web infrastructure, it threatens millions of apps and poses major supply chain security risks.
NIST will cease rating low and medium severity vulnerabilities, redirecting resources to critical flaws amid unprecedented submission volumes. Security teams must find alternatives for patch prioritization as the shift trades granular threat intelligence for faster processing of high-impact vulnerab
A bug in Microsoft Edge disables right-click paste in Teams, disrupting workflow for enterprise users. Keyboard shortcuts still work, but Microsoft has issued an urgent advisory as affected organizations seek workarounds.
A critical remote code execution flaw in protobuf.js enables unauthenticated attackers to execute arbitrary code via malicious protobuf messages. With public exploit code now available, millions of JavaScript applications processing untrusted serialized data face immediate exploitation risk.
NAKIVO v11.2 strengthens ransomware defense with immutable backup copies that resist deletion attacks. The update adds expanded hypervisor support to protect critical backup infrastructure from compromise.
Tycoon 2FA's disruption distributed its 2FA bypass capabilities across competing phishing kits instead of eliminating the threat, intensifying credential-theft attacks at scale. Threat actors rapidly repurposed the platform's tools, demonstrating that dismantling a single service rarely reduces risk
Grinex, a U.S./U.K.-sanctioned Kyrgyzstan crypto exchange, shut down after losing $13.74M to a breach it attributes to Western intelligence agencies. The incident highlights tensions between geopolitical conflict, cybersecurity, and digital asset regulation.
Ghost identities—forgotten service accounts and API keys—caused 68% of 2024 cloud breaches. Organizations lack visibility over 40-50 automated credentials per employee, leaving critical systems dangerously exposed.
** A new Mirai variant called Nexcorium is exploiting CVE-2024-3721 in TBK DVRs and EoL TP-Link routers to build a DDoS botnet, with peak attacks hitting 1.2 Tbps. Patch, segment, or replace affected
White House Chief of Staff meeting with Anthropic CEO on AI security reflects a shift from regulation-focused oversight to proactive, direct government engagement with advanced AI developers.
Tycoon phishers abandoned traditional 2FA interception for device code phishing, tricking victims into authorizing attackers' devices instead. This approach exploits legitimate auth flows designed for browserless devices, completely bypassing 2FA protections.
NIST is reducing its CVE data enrichment responsibilities due to resource constraints and scalability challenges, shifting from a centralized model to a distributed ecosystem. Industry coalitions must now fill the gap in providing vulnerability context, severity ratings, and impact assessments that
Payouts King ransomware evades EDR tools by executing payloads in QEMU virtual machines. This fragmentation bypasses detection and complicates forensic investigation.