ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Over 1M phishing emails use "text salting"—hidden text that confuses AI security filters. Attackers weaponize LLMs to generate retail scams at scale, reaching inboxes despite advanced defenses.
Ransomware hit Coca-Cola's Fairlife dairy unit, halting U.S. production of milk and protein drinks. Production systems were compromised; Canadian ops unaffected and product safety confirmed.
Rockwell Automation communication modules (1756-EN2/EN3/ENBT) contain a critical DoS vulnerability allowing unauthenticated network attackers to disrupt connections via malicious CIP packets. The flaw requires no authentication and can be exploited repeatedly, potentially disrupting industrial opera
A stored XSS flaw (CVE-2026-9292) in Rockwell DataMosaix's Workflows lets authenticated attackers inject persistent scripts for credential theft and operational disruption in manufacturing systems.
CVE-2026-11889 allows authenticated attackers to bypass tenant isolation in SALTO ProAccess Space. The privilege escalation breaks multi-tenant logical separation, amplifying insider threat risk across enterprise facilities.
OkoBot malware deploys 20+ payloads to steal crypto keys and financial credentials from targeted users. The modular framework suggests professional threat actors conducting coordinated campaigns.
A critical vulnerability in Claude for Chrome enables malicious extensions to hijack AI operations and access Gmail, Drive, Calendar, and Salesforce without user consent. The flaw exploits insufficient isolation between browser extensions, allowing attackers to simulate user interactions and abuse t
Four critical vulnerabilities in Siemens SICAM 8 enable authentication bypass and firmware compromise, threatening power grids and manufacturing systems worldwide. Patches available in version V26.20; immediate patching required.
Rockwell Automation patched three critical DoS flaws in PLC controllers allowing remote attackers to trigger system failures via malicious files, potentially halting manufacturing operations.
Israeli startup Oak launches from stealth with $60M in seed funding to consolidate fragmented identity governance through an AI-powered platform. It unifies governance of human, machine, and AI identities into a single operating system, addressing enterprises' struggles with disconnected IAM tools.
15+ coordinated attacks exploit legitimate delivery—NuGet, Chrome defaults, installers. Attackers favor social engineering over zero-days, using Google Sheets and Telegram for command-and-control.
Two Scattered Spider members, ages 18 and 20, were sentenced to 5.5 years for a £29 million attack on Transport for London that disabled 148 systems and affected 9 million daily commuters.
ClickLock Stealer, a macOS malware targeting 100+ users across 33 countries, uses social engineering to steal browser data, cryptocurrency credentials, and system information exfiltrated via Telegram-controlled channels.
AI data centers scale faster than security can keep pace. Integrated GPU systems—unlike isolated traditional servers—create novel attack surfaces that legacy practices don't address.
OT systems controlling critical infrastructure were designed without security and cannot safely restart like IT systems. Standard IT vulnerability management is risky here—forcing a patch that restarts a power grid's controller could cause more real-world harm than leaving the vulnerability unpatche
Agent data injection corrupts trusted data fed to AI agents rather than hijacking their instructions, enabling attackers to misdirect shopping agents, trick coding assistants, and inject malicious code into production while evading modern defenses.
n8n's token exchange flaw validates JWTs using only the `sub` claim, ignoring the `iss` issuer claim. This allows attackers with valid tokens from one trusted provider to impersonate users from another, affecting Enterprise instances with multiple configured token issuers (CVE-2026-59208, CVSS 7.6).
ClickLock is a macOS infostealer that crashes apps every 210ms until users surrender credentials. It spreads via a Terminal command and uses fake dialogs and LaunchAgent persistence.
TELEPUZ malware spreads via ClickFix lures on compromised websites, stealing data and executing remote commands on infected systems. Its modular architecture allows attackers to customize payloads for specific targets while evading detection through reduced footprint and flexible deployment.
Two senior Scattered Spider members were sentenced to 5.5 years for orchestrating a 2024 Transport for London cyberattack that compromised critical infrastructure. The conviction signals escalating law enforcement action against organized cybercriminal groups.
23andMe settled for $18 million with 43 states over a 2023 breach that exposed genetic data to millions. The breach stemmed from credential-stuffing attacks and weak MFA.
AI agents operate at machine velocity with opaque logic, breaking legacy security controls designed for human-speed workflows. Attackers weaponize AI agents faster than defenders can understand and detect them, requiring entirely new security paradigms rather than patched defenses.
Researchers exposed PhantomEnigma: a campaign that compromised 20+ Brazilian .gov.br sites to distribute malware via fake government emails with valid digital signatures, bypassing email security.
Spirals, a new Rust-based ransomware, breached a South Asian IT firm in 24 hours after systematically disabling antivirus and 23 critical services including Veeam and VMware. Its precision and speed underscore urgent needs for faster threat detection and response capabilities.