ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
PHANTOM-B exploits Hugging Face's 700k-model hub as a supply-chain vulnerability. Unlike code attacks, poisoned ML weights hide payloads in data itself, creating risks developers largely ignore.
France's tax agency breached via stolen credentials; 680,000 people's data leaked. Officials discovered it only from a hacker's forum post. The financial data enables social engineering attacks.
Evooo1Bot is an evolved Mirai botnet with encrypted C2, SSH scanning, credential theft, and old exploits targeting unpatched edge devices—far more sophisticated than typical Mirai variants.
Iranian-linked Cavern is a modular C2 framework hiding commands in Microsoft 365 calendars as dead drops. Its plugin system deploys only mission-specific tools per attack phase, minimizing forensic exposure if detected.
Critical Forminator plugin flaw (CVE-2026-15748) enables unauthenticated remote code execution on 600k+ WordPress sites via unvalidated file uploads. Trivial mass exploitation is possible; attackers can steal credentials, install backdoors, and compromise servers.
Snowflake's .NET connector repo had a GitHub Actions workflow that processed unsanitized GitHub issue titles, allowing attackers to inject commands and steal Jira credentials.
GitHub's global outage halted CI/CD pipelines, APIs, and deployments worldwide. The incident exposed the industry's risky concentration of critical development infrastructure in a single platform.
CEVA Logistics' breach exposed Pokémon Center customers to phishing and social engineering. The attack reveals how third-party vendors—not brands—are the weakest link in customer data security.
A hacker is selling 3.6M employee records from Fortune 500 Azure tenants, obtained through stolen credentials—not technical exploits. This demonstrates credential theft as the primary security gap, even for well-funded enterprises.
A Unisoc modem exploit chain achieves full Android kernel access by exploiting shared memory between modem and application processors. The attack requires attacker-controlled private 4G network access and remains unpatched.
MCP servers store credentials in plaintext config files, creating a new attack surface security teams lack visibility into. This repeats the credential vulnerabilities that plagued cloud deployments.
Three nation-state campaigns dominated the week: China exploited VMware vCenter with ransomware-as-cleanup, Lazarus hit defense firms via Windows zero-day, and macOS miners spread via Screen Sharing. Unpatched systems enabled every attack.
A zero-day vulnerability in Microsoft Defender (CVE-2026-69414, dubbed "ShieldBreak") could grant attackers kernel-level access on Windows systems. The researcher disclosed technical details publicly before Microsoft issued a patch, creating immediate risk for millions of unpatched machines.
France's tax authority leaked 678,000 files with income, assets, banking details, and IDs. Such breaches are uniquely damaging because tax agencies hold comprehensive personal financial profiles.
Clop ransomware targets GE and Philips, stealing critical infrastructure data from military, nuclear, and healthcare systems. The gang exploits file-transfer software vulnerabilities for data extortion, threatening to publish stolen data unless ransom is paid.
Windows Server 2022 exits mainstream support October 2026, moving to security-only patches. Without compatibility fixes, organizations face third-party conflicts and increased threat activity.
CVE-2026-54121 (Certighost) allows standard domain users to request certificates that are processed as Domain Controller accounts. This enables Tier 0 privilege escalation in minutes without lateral movement or special privileges.
The vulnerability tracked as CVE-2026-58231 can be exploited to execute arbitrary code and compromise internal components. The post Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosure appeared first on SecurityWeek.
Claude outage exposed a critical risk: AI has become essential infrastructure. When Anthropic's API went down, thousands lost vital tools—proving reliability matters as much as safety positioning.
UK venues are banning Meta's Ray-Ban smart glasses as regulators stall, citing privacy risks. Unlike visible phones, the glasses look indistinguishable from normal eyewear but can covertly record conversations, faces, and audio for AI analysis—an asymmetry that venues can't reliably enforce against.
A threat actor claims millions of records stolen from McDonald's, TCS, and Vodafone via Azure. While unverified, the claim fits a real attack pattern as Azure faces sustained security pressure.
SafePal exposed 40k customers' order data (names, addresses, purchase dates) in a security breach. The stolen information creates a targeting profile for criminals to identify and attack crypto holders through robbery, SIM-swaps, and phishing.
AmnesiaStealer steals browser sessions, not passwords. The macOS malware hijacks live authenticated browsers, letting attackers operate as you in real time.
Swiss encrypted messaging app Threema was knocked offline by DDoS attacks. When encryption can't break, attackers hit availability—targeting a platform popular with journalists and activists.