ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure
The full HackWire archive — 3,887 stories, newest first.
Zoom patched CVE-2026-53412, a critical Windows vulnerability (CVSS 9.8) enabling unauthenticated account takeovers affecting millions without requiring user interaction. Three additional high-severity flaws were also fixed.
OpenAI deployed GPT-Red to autonomously hunt prompt injection flaws, reducing vulnerabilities 6x in GPT-5.6 Sol. The automated red-teaming system replaces manual testing and addresses growing security threats from agentic AI systems with expanded attack surfaces.
Legacy Microsoft-signed UEFI shim bootloaders contain critical vulnerabilities enabling Secure Boot bypass on any system. Attackers can inject unsigned code at the firmware level before OS protections activate, affecting Windows, Linux, and other platforms regardless of installed OS.
Spanish police dismantled a €140M cyber fraud ring spanning multiple European countries that used BEC attacks, phishing, and romance scams to target businesses and individuals. The sophisticated operation featured coordinated money laundering through complex financial networks across several nations
Four security vendors patched critical vulnerabilities in endpoint tools, including remote code execution. The disclosures show how security products themselves are becoming high-value targets.
Researchers found 11 vulnerable UEFI shim bootloaders that bypass Secure Boot, allowing attackers firmware-level system compromise. These outdated components remained trusted by Microsoft despite known critical flaws, exposing millions of unpatched systems.
Dutch police dismantled a €100M investment fraud syndicate with 700+ operatives across 20 call centers in multiple European countries. The network defrauded tens of thousands of victims since 2021, with arrests across Cyprus, Greece, Belgium, and Poland.
Phishing and compromised credentials now drive 73% of ransomware attacks, replacing software exploits as the primary vector. Despite widespread MFA deployment, attackers favor these cheaper, more reliable human-centric tactics over technical exploitation.
Zoom patched critical CVE-2026-53412 (CVSS 9.8), enabling unauthenticated account takeover via improper input validation in Windows clients and SDK. Organizations should update immediately to patched versions (Workplace 7.0.0+, SDK 7.0.0+).
CISA and NSA release guidance on Coordinated Vulnerability Disclosure best practices for vendors, enabling faster patching and reducing exploit risk through clear researcher reporting policies.
The Cloud & Data Security Summit addresses multi-cloud security challenges facing enterprises using multiple cloud platforms simultaneously. As organizations adopt diverse cloud providers, threat actors increasingly exploit misconfigurations and weak access controls to breach systems.
Bitdefender found that Windows bind links enable malware to hide from EDR tools by creating conflicting filesystem views. This exposes a critical detection gap in endpoint security solutions.
TuxBot v3 Evolution is an LLM-generated IoT botnet containing leftover AI safety warnings. It shows cybercriminals are operationally using AI to create malware for DDoS and cryptomining attacks.
Russian hacker bandcampro weaponized Google's Gemini CLI to run a botnet and gain remote system access. The attack exploited trust in legitimate developer tools to evade network detection.
A patched Claude Desktop vulnerability, PromptFiction let attackers execute malicious prompts via `claude://` links without user approval, risking system compromise when combined with other flaws.
Trump's unexplained AI export restrictions on Anthropic and OpenAI exposed European dependence on US tech, sparking sovereignty concerns and questions about weaponizing critical infrastructure.
Russia's proximity to Europe creates concentrated cyber threats unlike North America's distributed risks. Dark Reading launches dedicated European coverage, signaling the need for region-specific defense strategies tailored to the continent's geopolitical reality.
OkoBot malware injects code into Ledger and Trezor wallet apps to trick users into revealing recovery phrases. Hundreds of victims across 25+ countries have been targeted since April 2025 by the framework's SeedHunter module.
AsyncAPI npm packages were infected with a credential stealer, reaching 2.25M downloads in 4 hours. Attackers exploited GitHub Actions misconfiguration to publish trojaned code.
CISA warns of critical SharePoint vulnerabilities under active exploitation. CVE-2026-56164 allows unauthenticated access; agencies have 3 days to patch. Related flaws enable security bypass and code execution.
Cursor (7M users) has an unpatched critical vulnerability allowing code execution on Windows via malicious git.exe in repo root. The tool automatically executes it when opening the project.
Cribl acquired CardinalOps to add AI-driven detection engineering to its security platform, enabling organizations to map their security controls against MITRE ATT&CK and identify coverage gaps. The move helps CISOs demonstrate comprehensive threat detection coverage and operationalize security tele
Cursor AI's critical 2-click vulnerability lets attackers install malware and steal secrets from developers at 64% of Fortune 500 companies through flaws in Git and MCP server handling. The flaw exposes a blind spot: AI tool security remains overlooked despite widespread enterprise adoption.
Approved marketing tags silently load unauthorized third-party code that vendors chain together. This "Approval Gap" means unauthorized scripts access user data with zero audit trail or visibility.