ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure
The full HackWire archive — 3,887 stories, newest first.
7-Zip 26.02 patches a critical RCE vulnerability (CVSS 9.8) in versions 26.01 and earlier. Attackers exploit it by distributing malicious archives; opening them triggers arbitrary code execution with user privileges. Update immediately to block archive-based attacks.
Critical WordPress RCE vulnerability chain "wp2shell" (CVE-2026-63030 & CVE-2026-60137) now has public exploits and requires zero authentication. The pre-auth attack affects 500M+ WordPress sites—patch immediately.
Microsoft warns of surging ACR Stealer attacks targeting enterprises. This malware exploits social engineering and legitimate Windows tools to steal credentials, browser data, and Microsoft 365 documents.
Regulators worldwide now mandate age verification, but centralized facial recognition creates privacy risks. A new on-device approach validates age without capturing or transmitting biometric data.
Google Gemini's lock-screen access allows anyone with physical access to send messages without authentication. This enables impersonation, social engineering, and account compromise attacks.
Critical unauthenticated RCE in WordPress 6.9.0–7.0.1 via batch REST API endpoint affects 500M+ sites. Emergency patches released July 17, but no CVE assigned yet, blocking vendor detection and verification.
Abbott Labs faces dual cyber incidents: extortion gang ShinyHunters claims 30M+ customer records and 1M+ SSNs from Cancer Diagnostics; LabCentral portal separately compromised via credential theft. Reflects surge in healthcare-targeting extortion attacks.
Abbott Laboratories is investigating two cyber incidents where threat actors claim to have stolen sensitive data and are demanding extortion payments. The incidents reflect a broader escalation of ransomware and data theft attacks targeting critical healthcare infrastructure.
Two chained SonicWall SMA zero-days enable unauthenticated root access. Inc ransomware group actively exploits them to harvest credentials and deploy ransomware across enterprises.
OpenSSL HollowByte is a critical memory exhaustion vulnerability patched silently without CVE disclosure. Attackers can freeze up to 25% of server RAM using crafted 11-byte TLS requests; memory fragments permanently until process restart.
The White House launched Gold Eagle to centralize AI vulnerability disclosure and response, but critical implementation details—including coordination mechanisms and enforcement authority—remain unclear. The initiative aims to address unique AI security threats to critical infrastructure, where vuln
Seven malicious Vite npm packages deployed a blockchain-based RAT in a supply chain attack. The ViteVenom campaign leveraged obfuscated code and a four-tier blockchain C2 to achieve persistent access to developer machines.
Authority laundering exploits autonomous AI by disguising untrusted input as legitimate instructions. Attackers hide payloads in Morse code that AI systems translate and execute as valid commands, bypassing traditional security.
Chinese cyber group GoldenEyeDog breached DigiCert via social engineering to steal code-signing certificates in April 2026. This supply chain attack allows malware to evade security controls by appearing legitimate to endpoint protections.
NadMesh botnet targets exposed AI services to steal AWS keys and Kubernetes tokens. Operator's dashboard already shows 3,811 harvested credentials from thousands of compromised systems.
HollowByte is an OpenSSL DoS flaw letting attackers crash servers with just 11 bytes of unauthenticated traffic. Patched versions exist but rapid adoption across internet infrastructure is critical.
EY's support systems were breached, exposing client data. This supply-chain attack shows how infrastructure weaknesses in trusted advisors create risk across thousands of organizations.
Pentagon pauses CMMC Phase 2 audits citing auditor shortage and costs. Contractors still must self-attest compliance and meet DFARS requirements without third-party verification, creating legal and operational risk.
Beacon Security raised $13M for an AI-powered threat detection platform founded by Israeli defense veterans. It unifies security data and automates real-time threat hunting and response.
Autonomous AI agents are transforming security response but outpacing governance frameworks. MindStone Agent adds persistent memory to enable autonomous incident response coordination while raising accountability concerns.
Supply chain vulnerabilities dominated the week as major retailers fell victim through compromised third-party vendors. Ransomware drove a German textile firm into bankruptcy after a six-week shutdown, illustrating how interconnected security weaknesses cascade across industries.
Agentic AI operates autonomously across systems, creating novel security vulnerabilities. Orgs must choose: accept efficiency gains with new risks, or demand vendors address the trust problem.
Google Cloud integrates Wiz's platform for autonomous cloud security—"agentic defense" against AI-powered attacks. This aims to match the speed of AI-driven threats that outpace traditional SOC response times.
The White House's Gold Eagle Clearinghouse aims to coordinate AI vulnerability disclosure, but experts question its enforcement mechanisms and ability to match rapid AI development. Unlike traditional software, AI security flaws can be discovered and exploited within hours across fragmented stakehol