ACTIVE THREATS: Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure • CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV • Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent • Phishing Research Challenges Conventional Security Awareness Testing ACTIVE THREATS: Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure • CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV • Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent • Phishing Research Challenges Conventional Security Awareness Testing
The full HackWire archive — 3,882 stories, newest first.
ServiceNow patched a critical RCE flaw July 14, but a researcher-published exploit the same day led to real attacks within four days—too fast for enterprise patching cycles. Self-hosted customers faced the worst timing, unable to navigate change management fast enough.
Code Red infected 359,000 servers using a known, patched vulnerability. The real lesson: organizations lacked infrastructure visibility, a fundamental inventory problem that persists two decades later.
WordPress's wp2shell exploit chains a REST API route confusion bug with SQL injection to achieve unauthenticated remote code execution on default installations. The vulnerability affects roughly 43% of the web.
WSUS sync failed July 13 due to SUSDB metadata bloat, blocking patch delivery. Production systems require manual SQL cleanup to recover. The outage increases security risk across affected networks.
ENCFORGE is ransomware specifically targeting AI infrastructure—model weights, vector databases, and datasets—rather than general files. Deployed by threat actor JADEPUFFER via an unpatched Langflow RCE vulnerability, it exploits AI teams' typically minimal security practices.
Windows LegacyHive lets low-privileged users read sensitive registry hives and escalate to SYSTEM. No official patch yet, but third-party micropatches are available.
A two-flaw chain (CVE-2026-60137 + CVE-2026-63030) enables unauthenticated remote code execution on default WordPress installs. WP2Shell exploits reached widespread adoption within three days of disclosure—organizations should assume compromise if unpatched.
A hacker stole $23.75M from Ostium by manipulating price feeds. The attack exemplifies DeFi's ironic reliance on centralized oracles—the very intermediaries blockchain was designed to replace.
Two chained SonicWall vulnerabilities (SSRF and command injection) let attackers silently backdoor SMA1000 appliances for nearly four weeks, gaining root access and deploying persistent malware before detection.
Clop breached Estée Lauder's HR system using an unpatched Oracle zero-day (CVE-2025-61882), stealing SSNs, bank accounts, and employee records. The breach went undetected for ten months until June 2026.
An LLM found a CVSS 10 flaw in Ivanti Sentry that traditional tools missed, showing AI's potential for defensive security while raising questions about similar undiscovered vulnerabilities.
Ransomware now specifically targets AI models. JadePuffer's EncForge exploited Langflow and Docker to autonomously iterate attack scripts in five minutes, hunting ML infrastructure and model weights.
Pillar Security found seven sandbox escapes across AI coding tools. The core flaw: agents write files that host tools execute outside the sandbox, bypassing all agent-level security rules.
TFF Trap compromises credentials first, then launches BEC attacks using fileless malware and stealthy loaders. Executing payloads in memory through legitimate processes, the attack evades corporate detection so attackers already possess valid credentials when fraud hits the inbox.
One in four CISOs are leaving as organizations rapidly deploy AI without security governance. The real burnout isn't technical difficulty but futility—being excluded from key deployment decisions.
A coordinated campaign called FakeGit deployed 7,600+ malicious GitHub repositories impersonating AI tools, exploiting developer trust in GitHub's social signals while concealing malware in downloadable files. Over 800 specifically target AI developers by mimicking MCP servers and agent skills.
EY's tax platform breach exposed client SSNs, credit card numbers, and financial accounts—a complete identity theft kit. The attackers accessed the support ticket system undetected for 16 days, compromising sensitive tax documents used for account takeover and fraud.
The Hacker in a Hoodie Index, created by Richard Bird, replaces the cybersecurity industry's poorly-sourced trillion-dollar estimates with verified breach data from SEC filings and news sources. It refuses to sum incomparable losses into meaningless totals, offering a structured, graded, daily-updat
A threat actor left their dev server open, exposing a phishing campaign using WebDAV/CVE-2025-33053 to target Mexico. Researchers accessed 1,048 development files, build notes, and active campaign logs.
HollowGraph hides malware commands in Microsoft 365 calendar events dated 2050. Linked to Iranian intelligence, it compromised 12+ organizations through this covert channel.
An 11-byte OpenSSL denial-of-service vulnerability causes memory fragmentation requiring process restart. OpenSSL patched it silently with no CVE or advisory, raising concerns about responsible disclosure.
Two zero-days in SonicWall SMA1000 appliances were exploited for three weeks before disclosure on July 14. Threat actor UTA0533 deployed custom malware (KnuckleBall, OrangeTail) for lateral movement, indicative of state-sponsored APT activity rather than cybercrime.
Neo, a $100M startup, fills the agent governance gap—autonomous agents deploy with inherited permissions but no audit trails or enforcement. Its platform adds visibility and control to agentic software systems.
Cyber intelligence has become event security's true frontline. Vienna's 2024 Taylor Swift concert threat was neutralized weeks before the event via Telegram monitoring—attackers now target digital infrastructure (ticketing, hotels, transit systems) rather than physical venues.