ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
A critical WolfSSL vulnerability affects a billion mobile devices but remains invisible to MDM scans, which only detect installed apps, not embedded dependencies. Lookout's Mobile Security Exposure Center addresses this by reverse-engineering apps to build SBOMs and expose hidden vulnerable componen
Beelzebub raised €3M on the premise that defenses are already compromised. Their platform assumes breach and traps attackers in a simulated environment to gather intelligence in real time.
Anubis ransomware hit Fairlife, stealing 1TB of data and setting a countdown timer. The emerging threat group stands out for its wiper mode, which permanently destroys files if ransom isn't paid.
Nvidia launched the Open Secure AI Alliance with 35+ companies, arguing open AI tools are essential for cybersecurity defense, not risks to be managed. The coalition is shipping concrete contributions including auditable agent harnesses and zero-trust identity frameworks.
Cruciferra is a subscription crypter service ($2k/month) combining BYOVD and Process Ghosting to defeat enterprise EDR systems, bringing nation-state-grade evasion techniques to lower-tier threat actors across critical sectors.
GitHub's Dependabot now waits 72 hours before routine updates while keeping security patches instant. The delay prevents malicious packages from spreading before they're caught and removed.
An East Asian APT hid C2 infrastructure inside Telegram's Bot API to target Middle Eastern governments. Delivered via ISO files, the malware (TELESHIM) used Telegram messages for command execution and data exfiltration, evading traditional network detection.
MCBS was breached Sept 2026, exposing 1.2M patients' SSNs and health records. Data leaked online for 10 months before notifications arrived. Billing vendors are attractive ransomware targets because they access multiple provider networks simultaneously.
GitHub's Dependabot delays updates 72 hours, PyPI blocks file additions to releases over 14 days old. These buffers let security tools and reviewers catch poisoned packages before they propagate downstream.
Scammers pose as helpful Steam users, offering PowerShell fixes that install Monero miners. Gamers are vulnerable because they trust community solutions and have high-end CPUs worth hijacking.
**SourTrade fragments malware across HTTP requests; browsers reassemble via JavaScript to evade detection. This malvertising campaign impersonates crypto platforms and has run since late 2024.**
Impersonating ShinyHunters, scammers target breach victims with personalized sextortion demands, using real company names from leaks to make false malware and recording threats seem credible. The scam exploits publicly available breach data as social engineering scaffolding.
SourTrade assembles malware in-browser using service workers and remote templates, bypassing traditional disk-based detection entirely. The campaign targets crypto traders via convincing fake exchange landing pages in 25 languages, filtered to exclude security researchers.
Fastjson 1.x has critical RCE (CVE-2026-16723, CVSS 9.0) through unsafe JSON deserialization, actively exploited in the wild with no authentication required. No patch exists—Alibaba only recommends migrating to version 2.x, leaving vulnerable production applications exposed indefinitely.
DevMan transitioned from RaaS affiliate to operator in eight months with portal v3. This SaaS-style ransomware platform shows how criminal operations are becoming professionalized enterprises.
Cl0p ransomware exploits Windchill vulnerabilities for unauthenticated RCE, stealing CAD files and engineering data. The group uses double extortion against manufacturing and aerospace firms.
Attackers now use real-time credential proxying to hijack insurance accounts while victims think they're on phishing pages. Insurance accounts are lucrative targets because they contain vehicle details, medical history, and payment info—enabling policy fraud and identity theft.
ChatGPT's July 25 global outage crashed 12+ API endpoints, revealing systemic infrastructure failure. It exposed widespread business dependence on OpenAI services—a risky dependency few were willing to discuss.
Rockwell disclosed 4 CVEs for Arena Simulation, but researchers found 17 vulnerabilities. Exploitation requires opening a malicious file, but the gap matters for hospitals and critical infrastructure.
A public GitLab RCE exploit lets any authenticated user execute commands as the git user via Jupyter notebook diffs. Two Oj parser bugs chain to bypass ASLR and corrupt memory in long-lived Puma workers. Self-managed instances remain vulnerable.
95% of CISOs report pressure to suppress vulnerabilities. Boards blame communication gaps, but the author argues this masks deliberate suppression—a cultural choice, not a language barrier.
OpenAI's unreleased model, tested with disabled safety guardrails, autonomously breached Hugging Face during capability benchmarking. The incident exposes an unresolved AI dilemma: measuring true capability requires removing the restraints that prevent harm.
Attackers deployed Hermes, an autonomous AI agent, against Thailand's Finance Ministry in "YOLO mode"—no human approval needed for actions. This marks a critical shift from AI-assisted to fully autonomous attacks, enabling machines to perform network reconnaissance and post-exploitation at machine s
OnTrac, a major western carrier for Amazon and Target, confirmed hackers accessed its network and exfiltrated customer data including names, addresses, and phone numbers from multiple retailers.