ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Evooo1Bot is a modular botnet that turns routers into SOCKS5 proxies, monetizing residential IPs for fraud rings and state actors. Unlike traditional Mirai variants focused on DDoS attacks, this newer version prioritizes profitable proxy services and targets diverse device types across networking eq
Metasys vulnerabilities (CVSS 8.6) expose building automation systems in hospitals and data centers to remote attack, allowing unauthorized access to HVAC, fire suppression, and access controls. Exploits require no authentication, and under-monitored deployments lack adequate security oversight, amp
Anthropic's text watermarking addresses plagiarism but masks deeper concerns about criminal attribution and disinformation infrastructure. The approach is fragile, easily defeated through paraphrasing or editing.
"Poison Claude" is a man-in-the-middle scam routing API calls through attacker infrastructure under guise of 90% discounts. Users expose all prompts and data to credential theft and exfiltration.
A leaked AWS key embedded in Beacon CRM's public JavaScript exposed donor data from 1,000+ nonprofits. The breach underscores why "secrets in build artifacts" persists as a critical vulnerability: attackers need only freely available scanning tools, not sophistication, to find and exploit exposed cr
RingCentral breach: 1.6M business contacts stolen and publicly circulated. The critical issue is publication—data is now actively available to attackers for phishing, not a future theoretical risk.
Google's post-quantum deadline is 2027 to counter 'harvest later' attacks on today's encrypted data. NIST finalized standards in 2024; migration of legacy RSA/ECDSA infrastructure is the challenge.
The attack blamed on LiteLLM was actually driven by poisoned Trivy security scanners deployed five days earlier. Attackers exploited organizations' trust in this CI/CD scanning tool to harvest credentials across 2,000+ companies before anyone noticed.
Lazarus Group's 2016 SWIFT attack exploited business process knowledge—not technical flaws—to nearly steal $951M. This forced banks to shift from compliance-based to threat-informed security.
A Crown Office breach via third-party vendor exposed sensitive Scottish legal data across multiple government agencies. The incident reveals systemic failures in government vendor oversight and risk management.
NIST's vulnerability database is overwhelmed by AI-accelerated bug discovery. Unenriched CVEs force security teams to patch blind, without CVSS scores or threat data needed for prioritization.
A macOS Screen Sharing authentication bypass is being actively exploited to deploy Monero miners without passwords. Attackers gain graphical control of vulnerable machines for cryptojacking, with public exploit code accelerating real-world attacks.
Seven arrested for €30M Commerzbank fraud via service provider vulnerability, not direct bank attack—showing third-party vendors have weaker security than major banks themselves.
Cyera acquired security firm Oasis to manage AI agent credentials. Enterprise agents now access databases and APIs autonomously, but companies can't track their credentials—a major blind spot.
North Korean operatives penetrated US government via employment fraud. A coin-sized device hacks aircraft. Modern threats exploit physical access and social engineering rather than just digital vulnerabilities.
Boards miss infrastructure risks because they measure returns, not prevention. Legacy systems cause cascading failures invisible until catastrophe, despite years of engineer warnings.
DecryptAds reveals surveillance infrastructure hidden in adtech disclosure files by correlating publicly available records. ESPN's network uses 19 data brokers collecting geolocation and device fingerprint data—technically public, practically invisible until now.
Contractor Daniel Rhyne was sentenced to 2 years for extorting Brightly Software with stolen customer data. His case highlights risks from contractors with broad system access but minimal accountability.
ShinyHunters breached RingCentral, stealing 1.6M accounts. The threat is severe because RingCentral handles critical business communications infrastructure for tens of thousands of companies.
Shell confirms a Clop ransomware breach claiming 89GB exfiltrated—their second incident with the gang. Clop targets enterprise file-transfer tools like Accellion FTA, not perimeter defenses.
A maximum-severity RCE vulnerability in SAP Commerce Cloud was exploited by threat actors within 72 hours of patching, putting payment systems and customer data at major retailers at immediate risk.
Attackers steal OAuth tokens from compromised browsers, bypassing MFA to access Gmail, Drive, and connected apps. Traditional security controls designed to stop phishing and credential theft don't prevent this attack vector.
Siemens Desigo building controllers contain unauthenticated remote access vulnerabilities including hard-coded credentials and buffer overflows, threatening critical infrastructure like hospitals and airports that rarely patch their operational technology systems.
Siemens License Server vulnerability (CVSS 8.8) enables path traversal and privilege escalation in industrial networks. Often overlooked during patching, SLS compromise threatens critical engineering tools across manufacturing and infrastructure sectors.