ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Threat actors used Claude as an intelligent automation layer for multi-stage cyberattacks, leveraging its legitimate reasoning and code-generation capabilities rather than fighting guardrails. They combined the model's speed and adaptability with human intent to automate reconnaissance, payload gene
CISA is demanding end to corporate spin: breach disclosures must now specify affected systems, incident timelines, and technical indicators instead of vague, legally hedged statements.
AI eliminates phishing's old tradeoff: threat actors now deploy a million personalized emails in 72 hours, each contextually tailored and harder to detect than generic mass campaigns.
Microsoft released 974 patches in September—a record—including two exploited zero-days and a critical RCE (CVSS 9.8). The 2026 running total of 2,600+ already exceeds any prior full year.
Security teams chase critical CVSS scores but miss real threats. CVSS measures theoretical risk in a vacuum, not actual exploitability—attackers weaponize medium/high severity bugs that compliance-focused teams ignore.
Hackers abused Claude to mass-extract hardcoded secrets from 1.8M Android apps. The vulnerability isn't novel, but LLM automation eliminated manual effort—scaling analyst work into continuous queries.
Chinese AI labs including DeepSeek made millions of unauthorized queries to Claude to train competing models—violating terms of service through coordinated "illicit distillation" attacks.
GitLab CVE-2026-85706 is a CVSS 10.0 path traversal enabling unauthenticated file disclosure of secrets, credentials, and source code. Active probes detected within hours of patch release—immediate patching essential.
Attackers exploit JFrog Artifactory to deploy Rust backdoors and gain admin control of artifact repositories. This enables direct supply-chain manipulation, with Rust evading legacy detection tools. (197 characters, 2 sentences)
Threat groups are exploiting passkey adoption through convincing fake enrollment prompts, intercepting session tokens from users unfamiliar with new authentication flows. Attackers target the migration window when users don't yet recognize legitimate passkey prompts, using adversary-in-the-middle ta
Florida's DAVID database was breached using stolen police credentials, exposing driver records. The attack used authorized access, not exploits, revealing law enforcement credential vulnerabilities.
Microsoft's August 2026 Patch Tuesday broke Teams and Outlook on ARM Windows devices by disrupting the x64 emulation layer. A fix has been released, but ARM's fragile update track record remains a persistent enterprise concern.
GitLab disclosed a maximum-severity path traversal flaw (CVE-2026-85706) in self-managed instances, allowing unauthenticated remote attackers to access source code, credentials, and CI/CD configurations. Urgent patching required.
Attackers exploit Claude/ChatGPT's credibility by weaponizing Artifacts and shared conversations to deliver malware and harvest credentials via social engineering. The borrowed trust in legitimate AI platforms makes these social engineering attacks unusually effective.
Android ransomware now combines encryption, credential theft, and harassment via victims' contacts. The attack exfiltrates data first, maintaining leverage even if victims refuse to pay.
Brevo's breach exposed 347,000 Trezor users to phishing attacks for seed phrases. Attackers sent spoofed emails tricking users into revealing wallet recovery codes—permanent access to their crypto.
PaperCut released official patches for two actively exploited vulnerabilities in its print management software. Users must upgrade to versions 26.0.5, 25.0.13, or 24.1.10 immediately to prevent compromise.
Chinese APT UNC3569 exploited Sogou Input Method to drop GRAYRABBIT backdoor on 450+ million users. The keyboard software's deep OS access enabled full user-level compromise via a crafted link.
Attackers chained two Artifactory vulnerabilities to gain admin access and persistence on build systems, enabling them to inject malicious code into downstream software supply chains. This attack underscores the critical risk of unpatched DevOps infrastructure that sits upstream of all shipped softw
Microsoft's September 2026 security patches broke Remote Desktop Services across Windows Server 2019, 2022, and 2025, locking admins out of production servers. Some systems require physical resets to restore access.
A Conti ransomware member received four years for extracting $180M+ from hospitals and governments in 2021-22, raising questions about whether the punishment fits the massive scale of cybercrime.
**Three threat groups (ransomware operators and nation-state actors) are actively exploiting two Cisco Firewall Management Center vulnerabilities. FMC is the management plane controlling all firewall policies; compromising it grants attackers complete visibility and control over an organization's en
A Russian-linked threat actor deployed hundreds of AI agents to exploit PaperCut NG/MF print management software across 395+ organizations in a methodical, automated campaign. This marks a watershed moment where AI automates sophisticated cyberattacks at global scale, targeting unpatched systems in
Microsoft's KB5002914 patch broke Excel's core functions (copy-paste and formula dragging), forcing users to uninstall the security update entirely. This teaches enterprises that patches cause more harm than protection, creating a security crisis bigger than any original vulnerability.