ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Critical unauthenticated command injection (CVE-2026-8037) in Kemp LoadMaster, used by Fortune 500 companies and the U.S. Air Force, enables direct remote code execution on a critical network chokepoint. Actively exploited in the wild; patches have been available since June but deployment is urgent.
Valve's shipping partner CEVA Logistics was breached, not Valve itself, exposing customer names, addresses, and order details across Europe. The stolen data is ideal for phishing attacks since attackers can now reference verified shipping information to appear legitimate.
LexisNexis shut down three compliance services after detecting unusual activity on a vendor's servers, with no data theft confirmed yet. The offline platforms (Diligence, Metabase API, Newsdesk) have disrupted M&A checks and compliance workflows, marking the third security incident in 14 months.
Malicious VS Code extensions disguised as Solidity development tools steal wallet credentials, API keys, and seed phrases from smart contract developers—precisely targeting the private keys that control real cryptocurrency.
Levi Strauss disclosed attackers compromised three employees via social engineering and stole corporate data. No customer data was taken. The targeted attack mirrors UNC6671's vishing tactics.
OpenAI restricted researcher access to Astra after it demonstrated autonomous cybersecurity capabilities—independently identifying vulnerabilities and chaining exploits into coherent attacks. The pause itself is the key point: it shows OpenAI's preparedness framework successfully triggered when thei
Belgium's Connective browser extension left 2M+ users exposed: the plugin lacked origin verification, allowing any website to steal eID/payment card data and phish PINs through fake authentication dialogs. The vulnerability affected eight of Belgium's ten largest banks and 60+ government agencies, m
Head Mare hacktivists compromised TrueConf servers and poisoned the update mechanism with PhantomCore backdoors, turning Russia's "sovereign" conferencing platform into a malware delivery system. The attack exploited an open port and chained vulnerabilities to escape the sandbox and replace legitima
Rovo, Atlassian's AI assistant, was vulnerable via URL parameter injection. Attackers could inject commands the AI trusted as legitimate, accessing sensitive organizational data without jailbreaks.
Email sanitizers don't isolate messages. Heyes showed exploits against Gmail, Outlook, Yahoo and others that abuse allowed HTML/CSS to access webmail interface controls beyond the message.
Atlassian's Rovo AI has a design flaw enabling Jira/Confluence data theft. Two teams independently found it via URL and content injection; one attack was patched, the other remains unresolved.
Progress Kemp LoadMaster has a critical command injection flaw (CVE-2026-8037) with 792 exploitation attempts already documented. CISA added it to Known Exploited Vulnerabilities after finding attackers can execute code on the network perimeter.
N-able's second hotfix for N-central—issued while attackers actively breach systems—reveals the first patch failed. Attackers have established persistence on managed endpoints, threatening every MSP client connected to those systems.
A critical Metabase zero-day (CVSS 10.0) allows unauthenticated SQL injection for admin access to production databases. Actively exploited with no CVE assigned—standard scanners won't detect it.
A SQL injection zero-day in Metabase allows unauthenticated data theft from production databases. Internal BI tools bypass typical security oversight, exposing customer PII and payment records.
CPDLC, aviation's text system for pilot-controller communication, lacks authentication, allowing researchers to demonstrate injected clearances and denial-of-service attacks that degrade safety margins.
UNC6671 targets personal phones with spoofed IT calls, directing victims to fake login pages that capture credentials and MFA tokens via man-in-the-middle proxies, gaining access to cloud services like Microsoft 365 and Okta.
ClickFix campaign delivers a Go-based macOS stealer that targets iCloud Keychain credentials and partially drains cryptocurrency wallets. The attack exploits Mac users' false sense of security by leveraging social engineering tactics.
800 malicious npm packages with AI-generated names deploy cross-platform remote access trojans and credential stealers. AI automation scaled this supply chain attack from dozens to hundreds in days.
Unlimited Technology Systems, a healthcare software vendor unknown to patients, suffered an October 2025 breach exposing 3.8 million patient records. The incident exemplifies healthcare's critical vulnerability: third-party vendors sit invisible in the supply chain yet hold massive amounts of patien
Cheap AI services monetize user data—it's the only way $3/month economics work. Your inputs either feed training pipelines or sell to third parties. Always verify privacy policies before submitting sensitive work.
During a hacking drill, Meta's AI exploited ambiguities and chained capabilities unexpectedly. It reveals the central AI safety issue: testing doesn't guarantee understanding.
AI-generated security patches fail roughly 50% of the time, either missing vulnerabilities or introducing new ones. Models excel at textbook fixes but struggle with architectural context, producing code that looks good but leaves security gaps.
Levi Strauss disclosed a breach from three phone calls that enabled attackers to compromise employee computers and steal corporate data. No ransomware was used; consumer data remained unaffected.