ACTIVE THREATS: Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure • CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV • Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent • Phishing Research Challenges Conventional Security Awareness Testing ACTIVE THREATS: Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure • CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV • Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent • Phishing Research Challenges Conventional Security Awareness Testing
The full HackWire archive — 3,882 stories, newest first.
Apple's Hide My Email leaked real addresses in local logs for a year before patching in July. Risk: shared devices and malware could expose hidden emails despite network-level privacy protections.
Anubis ransomware breached Fairlife (Coca-Cola's dairy unit) and threatens to release stolen data unless ransom is paid. The attack exploits security gaps typical of acquisitions through double-extortion tactics.
Attackers exploiting SharePoint's CVE-2026-50522 steal machine keys to forge authentication indefinitely, bypassing patching. The RCE is just the entry point; the real prize is durable admin access regardless of vulnerability fixes. (169 characters, 2 sentences)
Cisco's Antares models target the vulnerability triage gap: large LLMs excel at finding vulnerable code patterns but are expensive with data sovereignty concerns, while cheap small models stay private but produce false positives. Antares aims for the middle ground.
A Trump EO extends supply chain audits to cloud providers serving defense contractors. It mandates "indentured Bill of Materials"—tracking not just software components but also supplier origins, locations, and foreign government ties.
Google's Gemini 3.5 Flash Cyber found 55 vulnerabilities in Chrome's V8 engine, outperforming competitors. It's optimized for rapid, low-cost scans that achieve breadth through multiple passes rather than single expensive deep dives.
AWS Kiro's approval system could be bypassed through hidden text in webpages. Attackers modified the MCP config file via fsWrite, launching malicious servers with full developer privileges.
Critical WordPress REST API flaws (CVE-2026-63030, CVE-2026-60137) enable unauthenticated remote code execution, exploited by attackers in just 13 minutes. Nearly 20% of WordPress sites—powering 43% of the internet—remain unpatched, exposing millions to credential theft and persistent webshell insta
Cl0p stole 870GB of Estée Lauder employee data (SSNs, passports, bank info) via an Oracle EBS vulnerability in August 2025. The company is notifying employees 11 months later, giving attackers nearly a year to weaponize the stolen credentials.
CISO Andreas Gaetje rose through audit, not hacking—a common but undervalued path. Auditors excel at business processes and risk communication, producing more security leaders than widely recognized.
HollowGraph exploits Microsoft 365 Calendar as a hidden C2 channel, hiding malware commands in fake 2050-dated events to evade network detection while blending in as normal calendar use. The implant reads operator-planted appointments via Microsoft Graph API and reports back by creating encrypted ca
SecurityWeek's Critical Impact Awards reject pay-to-play awards with free nominations and independent judging. Real expertise finally gets recognized over vendor marketing in industrial cybersecurity.
CVE-2026-50522 is a critical SharePoint RCE actively exploited to steal machine keys for persistent access. Observed attacks bypass authentication, contradicting Microsoft's advisory.
Empirical Security raised $25M Series A for a platform combining threat prediction with attack surface discovery, shifting security focus from reactive incident response to proactive breach prevention.
AI code security depends more on the framework than the model used. While AI-generated codebases average 15 vulnerabilities, the variance is driven by framework security defaults, not model choice.
Zimbra patched a command injection flaw in SNMP monitoring that grants attackers shell access with elevated privileges. The vulnerability persists because administrators enable SNMP during setup then forget it.
Qilin ransomware operators are exploiting CVE-2026-0257, an unauthenticated authentication bypass in Palo Alto's PAN-OS GlobalProtect VPN gateways, to gain initial network access for ransomware deployment. The vulnerability (CVSS 7.8) enables attackers to bypass credentials entirely and is actively
Stolen credentials compromise critical infrastructure—Colonial Pipeline via leaked password, Volt Typhoon via legitimate accounts. The gap: systems trust credentials without device verification or detecting compromise.
Researchers revealed Bit2Watt, a technique enabling cloud GPU tenants to threaten power grids by generating controllable power oscillations through synthetic workloads—no system breach or credentials needed.
AI collapses exploit generation from weeks to hours. Anthropic's Claude produced Firefox exploits in under an hour and Windows kernel chains for $2K, eliminating the time buffer defenders relied on.
Invisible text (rendered at 2% opacity) tricks AI agents into typing shell commands. Five mobile AI frameworks are vulnerable due to unsafe subprocess calls and poor input sanitization.
Qilin ransomware is actively exploiting CVE-2026-0257, a critical authentication bypass in Palo Alto's GlobalProtect VPN that requires no credentials to gain network access. Multiple breaches confirmed since May; patch immediately.
The DOJ's seizure of 1,970 piracy domains was actually a cybercrime infrastructure takedown, not just copyright enforcement. Arrested operators used stolen telecom access to run piracy sites for malware delivery, credential theft, and fraud.
Zimbra 10.1.20 patches an unauthenticated RCE in SNMP monitoring and multiple XSS flaws in the Classic Web Client. The RCE was publicly disclosed and unpatched for three weeks—a significant window of exposure on email infrastructure—and affects common enterprise monitoring configurations.