ACTIVE THREATS: PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws • China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor • Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors • Conti ransomware gang member sentenced to 4 years in prison • Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers ACTIVE THREATS: PaperCut Replaces Emergency Patches With Fixes for Two Actively Exploited Flaws • China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor • Attackers Chain JFrog Artifactory Flaws to Gain Admin Control and Plant Backdoors • Conti ransomware gang member sentenced to 4 years in prison • Cisco FMC flaws exploited by ransomware gang, state-sponsored hackers
The full HackWire archive — 3,852 stories, newest first.
CVE-2026-54121 (Certighost) allows standard domain users to request certificates that are processed as Domain Controller accounts. This enables Tier 0 privilege escalation in minutes without lateral movement or special privileges.
The vulnerability tracked as CVE-2026-58231 can be exploited to execute arbitrary code and compromise internal components. The post Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure appeared first on SecurityWeek.
Claude outage exposed a critical risk: AI has become essential infrastructure. When Anthropic's API went down, thousands lost vital tools—proving reliability matters as much as safety positioning.
UK venues are banning Meta's Ray-Ban smart glasses as regulators stall, citing privacy risks. Unlike visible phones, the glasses look indistinguishable from normal eyewear but can covertly record conversations, faces, and audio for AI analysis—an asymmetry that venues can't reliably enforce against.
A threat actor claims millions of records stolen from McDonald's, TCS, and Vodafone via Azure. While unverified, the claim fits a real attack pattern as Azure faces sustained security pressure.
SafePal exposed 40k customers' order data (names, addresses, purchase dates) in a security breach. The stolen information creates a targeting profile for criminals to identify and attack crypto holders through robbery, SIM-swaps, and phishing.
AmnesiaStealer steals browser sessions, not passwords. The macOS malware hijacks live authenticated browsers, letting attackers operate as you in real time.
Swiss encrypted messaging app Threema was knocked offline by DDoS attacks. When encryption can't break, attackers hit availability—targeting a platform popular with journalists and activists.
Evooo1Bot is a modular botnet that turns routers into SOCKS5 proxies, monetizing residential IPs for fraud rings and state actors. Unlike traditional Mirai variants focused on DDoS attacks, this newer version prioritizes profitable proxy services and targets diverse device types across networking eq
Metasys vulnerabilities (CVSS 8.6) expose building automation systems in hospitals and data centers to remote attack, allowing unauthorized access to HVAC, fire suppression, and access controls. Exploits require no authentication, and under-monitored deployments lack adequate security oversight, amp
Anthropic's text watermarking addresses plagiarism but masks deeper concerns about criminal attribution and disinformation infrastructure. The approach is fragile, easily defeated through paraphrasing or editing.
"Poison Claude" is a man-in-the-middle scam routing API calls through attacker infrastructure under guise of 90% discounts. Users expose all prompts and data to credential theft and exfiltration.
A leaked AWS key embedded in Beacon CRM's public JavaScript exposed donor data from 1,000+ nonprofits. The breach underscores why "secrets in build artifacts" persists as a critical vulnerability: attackers need only freely available scanning tools, not sophistication, to find and exploit exposed cr
RingCentral breach: 1.6M business contacts stolen and publicly circulated. The critical issue is publication—data is now actively available to attackers for phishing, not a future theoretical risk.
Google's post-quantum deadline is 2027 to counter 'harvest later' attacks on today's encrypted data. NIST finalized standards in 2024; migration of legacy RSA/ECDSA infrastructure is the challenge.
The attack blamed on LiteLLM was actually driven by poisoned Trivy security scanners deployed five days earlier. Attackers exploited organizations' trust in this CI/CD scanning tool to harvest credentials across 2,000+ companies before anyone noticed.
Lazarus Group's 2016 SWIFT attack exploited business process knowledge—not technical flaws—to nearly steal $951M. This forced banks to shift from compliance-based to threat-informed security.
A Crown Office breach via third-party vendor exposed sensitive Scottish legal data across multiple government agencies. The incident reveals systemic failures in government vendor oversight and risk management.
NIST's vulnerability database is overwhelmed by AI-accelerated bug discovery. Unenriched CVEs force security teams to patch blind, without CVSS scores or threat data needed for prioritization.
A macOS Screen Sharing authentication bypass is being actively exploited to deploy Monero miners without passwords. Attackers gain graphical control of vulnerable machines for cryptojacking, with public exploit code accelerating real-world attacks.
Seven arrested for €30M Commerzbank fraud via service provider vulnerability, not direct bank attack—showing third-party vendors have weaker security than major banks themselves.
Cyera acquired security firm Oasis to manage AI agent credentials. Enterprise agents now access databases and APIs autonomously, but companies can't track their credentials—a major blind spot.
North Korean operatives penetrated US government via employment fraud. A coin-sized device hacks aircraft. Modern threats exploit physical access and social engineering rather than just digital vulnerabilities.
Boards miss infrastructure risks because they measure returns, not prevention. Legacy systems cause cascading failures invisible until catastrophe, despite years of engineer warnings.