ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
HPE AOS-CX networking platform contains a critical authentication bypass allowing unauthenticated attackers to remotely reset admin credentials. The vulnerability provides immediate administrative access without requiring valid credentials or prior system compromise, exposing millions of network dev
Loblaw, Canada's largest grocer, experienced a major data breach exposing customer names, emails, and phone numbers. The exposure poses risks for phishing and identity theft, though payment card data wasn't compromised.
Vulnerability exploitation now dominates Google Cloud attacks over credential theft. Attackers exploit flaws faster than organizations patch, leveraging automation and zero-day stockpiles.
AI smartphone phishing defenses fail against targeted attacks, Omdia research shows. Attackers evolve faster than detection systems, using social engineering and technical evasion techniques.
Nonprofits face rising cyberattacks despite being mission-driven. Limited security budgets and access to sensitive donor data make them attractive targets for ransomware gangs and other threat actors.
Nonprofits face frequent cyberattacks but rarely report them, creating a data gap in threat intelligence. These organizations are attractive targets due to valuable data and limited security resources.
Microsoft patched a critical RRAS remote code execution vulnerability in Windows 11 Enterprise through an emergency hotpatch, allowing attackers to execute arbitrary code with elevated privileges. The severity triggered an out-of-band release bypassing the standard patch cycle for immediate deployme
** Starkiller is a new phishing-as-a-service platform that proxies real login pages in real time, capturing credentials and session tokens to bypass MFA. Only FIDO2/passkeys resist this attack.
GlassWorm compromised 72 Open VSX extensions to distribute malware targeting developers, escalating supply-chain threats by weaponizing trusted development tools with deep system privileges for unauthorized access.
Attackers hijacked AppsFlyer's Web SDK, injecting malware to steal cryptocurrency from affected users and organizations. The supply chain compromise reveals the massive risk when trusted software becomes weaponized—exposing thousands of dependent systems to attack.
Kimwolf, built from a weaponized vulnerability by operator "Dort," became the largest botnet ever. Dort escalated from cyber attacks to real-world violence against researchers, forcing law enforcement intervention.
March's 77 Microsoft patches span Windows, Office, and Edge with no active zero-days. Yet the broad attack surface—from RCE to privilege escalation—requires urgent prioritization.
Storm-2561 threat actors use SEO poisoning to trick users into downloading trojanized VPN clients from fake vendor sites. The digitally signed malware appears legitimate, creating an effective path to enterprise credential theft at scale.
INTERPOL dismantled 45,000 malicious IPs and arrested 94 cybercriminals, disrupting phishing and ransomware networks globally. The operation marks a shift toward proactive infrastructure destruction.
Chinese state actors target Southeast Asian militaries with custom malware (AppleChris, MemFun) for espionage and persistent network access in an ongoing campaign since 2020.
The FBI is hunting victims of a supply-chain attack exploiting Steam games, where at least 8 legitimate-looking titles secretly contained malware. Players unwittingly installed information-stealing tools while the games functioned normally, making detection difficult.
Microsoft is investigating a critical C: drive access issue on Samsung Windows 11 laptops following February 2026 updates. Affected systems cannot access the drive or launch applications, with the problem appearing limited to specific Samsung configurations.
Threat actor Storm-2561 distributes counterfeit VPN clients impersonating Ivanti, Cisco, and Fortinet to steal enterprise credentials. Spread via phishing emails and fraudulent download sites, the malware silently harvests logins before displaying error messages to maintain the deception.
Law enforcement sinkholed 45,000 IP addresses and seized servers in Operation Synergia III, one of the largest cybercrime infrastructure takedowns on record. The coordinated global operation redirects malicious traffic to law enforcement-controlled systems to identify victims and gather forensic evi
Microsoft is investigating widespread synchronization failures in classic Outlook affecting enterprises. Beyond productivity disruption, users may resort to unauthorized workarounds that could compromise system security. (164 characters, 2 sentences)
Poland's nuclear research center was targeted in a cyberattack, but security teams stopped it before any damage occurred. The incident highlights persistent threats to critical infrastructure in Eastern Europe.
Law enforcement dismantled SocksEscort, a botnet controlling 369,000 residential routers across 163 countries used to anonymize criminal fraud schemes. Attackers exploited the compromised home devices as proxy exit nodes, making illicit traffic appear to originate from legitimate ISP customers.
Nine "CrackArmor" vulnerabilities in Linux AppArmor allow unprivileged users to escalate to root and escape containers by exploiting confused deputy flaws in the access control system, threatening cloud infrastructure and containerized workloads.
Google patched two actively exploited Chrome zero-days: Skia graphics flaw (CVE-2026-3909, CVSS 8.8) enabling arbitrary code execution and a V8 JavaScript sandbox escape. Both require minimal user interaction—simply visiting a malicious website can trigger the vulnerabilities.