ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Apple's bug bounty program is choked with AI-hallucinated vulnerabilities, forcing submission caps that lock out real researchers. Paradoxically, Apple now uses AI to filter AI-generated noise—while security researchers struggle to submit legitimate findings.
Bendix patched critical remote code execution flaws in truck brake controllers via a safety recall, avoiding standard security disclosure norms. Attackers could have exploited the vulnerabilities to compromise commercial vehicle braking systems, highlighting risks in non-transparent automotive secur
UNC6671 operates a multi-brand vishing extortion operation using phone social engineering to steal credentials and data, then demands ransom—no malware, making it harder to detect. The threat actor group, operating under names like BlackFile, Redact, and Falcon, has built a multimillion-dollar extor
A critical pre-auth XSS flaw (CVE-2026-64638) on WordPress login screens affects all versions—no credentials needed. Attackers can chain it to PHP code execution for full server compromise. Patch immediately.
Coordinated cyberattack hit all three NC ports via shared IT systems, exploiting centralized administration. The incident reveals maritime infrastructure's vulnerability from converging IT/OT networks.
Compromised inboxes deliver banking malware via browser interception; clipboard swapping steals cryptocurrency. Two attack chains show adversaries exploiting human trust instead of technical vulnerabilities.
Attackers use voicemail-themed phishing emails with six-stage redirects through trusted services (Google, Amazon) to bypass security filters and capture credentials via AitM proxy.
NatJack exploits NAT's trusted-neighbor assumption to hijack TCP sessions, spoof DNS, and disable routing. It affects Windows, Linux, and multitenant cloud environments.
SCTPhantom (CVE-2026-64564), an 18-year-old SCTP vulnerability, enables root escalation and unprivileged container escapes via crafted packets exploiting pointer confusion during network path deletion. Tencent researchers demonstrated six of eight successful container escapes without requiring eleva
Open source faces a dual threat: AI-accelerated vulnerability discovery plus weaponized supply chain distribution. This creates a pincer attack on the unaudited dependency ecosystem.
Black Hat 2026 vendors hyped AI-native platforms while omitting failure rates and vulnerability details. The narrative shifted from cautious messaging to absolute claims, masking weak technical transparency between marketing promises and actual technical substance.
Microsoft fixed critical vulnerabilities across Azure, Entra, and SharePoint, while Apple patched a high-severity authentication bypass. The post Microsoft, Apple Release Fresh Security Updates appeared first on SecurityWeek.
Chrome 151 patched 24+ memory safety bugs, including critical use-after-free flaws enabling arbitrary code execution. The high frequency of these fixes reveals a structural problem: C++'s manual memory management leaves browsers perpetually vulnerable to exploitation.
Healthcare IT vendor UTS was breached, exposing 3.8M patients' medical and insurance data. These invisible intermediaries are lucrative targets for hackers seeking data for identity theft and fraud.
TeamPCP exploited exposed Redis servers for 5 years before pivoting to supply chain attacks. The group used consistent infrastructure and techniques across campaigns, evading detection until recently.
OpenAI's free ChatGPT upgrade amplifies threat actors' toolkit by narrowing the capability gap with paid tiers, enabling more convincing phishing and social engineering campaigns—a pattern the security industry repeatedly underestimates.
Cybercrime operates like efficient corporations with affiliate programs while defenders stay fragmented. This organizational gap, amplified by AI and crypto, is the defining security challenge of the decade.
A macOS infostealer discovered by Huntress uses ClickFix social engineering to trick users into running Terminal commands, then strategically drains crypto wallets while masquerading as Apple's trustd process—taking only enough to avoid immediate detection.
ABB's Zenon industrial automation platform bundles unpatched end-of-life MongoDB 4.2, exposing critical infrastructure like energy grids and water treatment facilities to unauthenticated heap memory disclosure attacks. Operators must manually update or uninstall the vulnerable component, as no autom
ChatGPT's supposedly isolated sandbox was breached through code injection that enabled persistent attacker influence. The quick patch masks deeper architectural vulnerabilities in AI system security.
UNC6671 extorts finance firms via social engineering, rotating brand names (BlackFile, Redact, Pink, Helix) to fragment attribution. The group has collected $10.6M+ in Bitcoin since early 2026.
RadiAnt DICOM Viewer has a high-severity out-of-bounds read flaw (CVE-2025-2550) triggered by malformed medical image files. It could leak patient data or crash in hospital radiology departments.
Johnson Controls TL280 alarm communicators deployed across critical infrastructure contain hardcoded firmware credentials, potentially allowing attackers to suppress alarms or access sensitive telemetry (CVE-2026-27871). The vulnerability affects thousands of facilities including manufacturing plant
The DNC learned security's hardest problem is human, not technical. With constant staff turnover and organizational chaos, traditional training fails. They solved it by making security absurd and memorable—an approach that reveals how organizational culture matters more than technical defenses.