ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure
The full HackWire archive — 3,887 stories, newest first.
Researcher Chaotic Eclipse released an exploit for a Windows User Profile Service flaw (LegacyHive) hours after Patch Tuesday, enabling privilege escalation to SYSTEM on unpatched systems. This near-immediate disclosure compounds risk for organizations still assessing patches in multi-user environme
SASE's network-level inspection misses modern threats: encrypted SaaS exfiltration, AI tool misuse, and application-layer data loss. Enterprise security now requires visibility beyond the network perimeter.
Critical browser vulnerabilities with public exploits affect Firefox and Chrome. Two Firefox flaws—a JavaScript engine vulnerability and site isolation bypass—enable arbitrary code execution and cross-site data theft, requiring immediate patching.
An automated AI system combines LLMs and code analysis to discover zero-days at scale, already finding WordPress vulnerabilities. Security teams now face an asymmetric threat environment.
AsyncAPI npm packages were compromised to distribute multi-stage botnet malware to developers through `npm install`. The attack highlights escalating supply chain threats targeting open-source repositories globally.
Gold Eagle is an AI-driven federal initiative to coordinate vulnerability detection and remediation across critical infrastructure, combining government agencies, open-source maintainers, and private-sector partners. It targets patching backlogs that leave power grids, water systems, and communicati
ServiceNow, Ivanti, and Fortinet released patches for 15 critical vulnerabilities. ServiceNow AI's unauthenticated RCE (CVE-2026-6875) is the most critical—attackers can execute code without credentials.
US indicts Russian operators of ML.Cloud and Media Land—bulletproof hosting services used for ransomware, phishing, and cyberattacks targeting Americans. DOJ offering $10M for information leading to arrests.
Cursor IDE executes arbitrary code from `git.exe` placed in repository roots without user confirmation. Opening an infected repo grants attackers full access to developer credentials and source code.
Three critical SharePoint vulnerabilities enable remote code execution and IIS key theft in active attacks across 800+ unpatched instances. Federal agencies must patch by July 17, 2026, or discontinue affected systems under CISA's binding directive.
Industrial control vendors released critical patches in July 2026, including a perfect CVSS 10.0 authentication bypass in Siemens OpenCenter X. Multiple critical flaws across Rockwell, Schneider, and other OT products create urgent remediation pressure for infrastructure operators.
Microsoft paused Windows 11 security update KB5101650 for Dell PCs after it caused unexpected shutdowns and battery drain due to an Intel driver incompatibility. The issue stems from a new USB-C Connection Manager interface that conflicts with Intel's thermal management driver.
Google and Mozilla released urgent browser updates (Chrome 150, Firefox 152) fixing critical vulnerabilities including RCE and sandbox escapes. Proof-of-concept exploits for Firefox are already public; immediate patching across all platforms is essential to prevent compromise.
Nigeria mandates cyberattack disclosure to address surging cybercriminal activity targeting businesses and critical infrastructure. The regulation joins global standards like those in the US and EU for improved threat transparency.
US charges three Russians for running bulletproof hosting supporting ransomware gangs that caused $62M+ in damages. They provided infrastructure for command-and-control, payments, and anti-takedown measures.
SonicWall warns of two actively exploited zero-day vulnerabilities in SMA1000 remote access appliances: CVE-2026-15409 (SSRF) and CVE-2026-15410 (code injection). Enterprises must patch immediately.
Two critical SonicWall SMA 1000 zero-days enable unauthenticated remote takeover. CVE-2026-15409 rates 10.0 CVSS with no auth needed. Exploitation confirmed.
**Summary:** Active exploitation of SharePoint Server vulnerabilities enables unauthenticated remote code execution across all supported versions, with attackers chaining multiple CVEs to establish persistence and steal credentials. CISA has declared the exploits as known-exploited vulnerabilities
ABB T-MAC Plus 4.0-24 has four critical vulnerabilities (CVSS 9.9) allowing privilege escalation and data theft in manufacturing systems. Authenticated users can execute admin functions without elevated credentials; upgrade to 4.0-25 immediately.
ABB Advant Master Online Builder (CVE-2025-13162) is vulnerable to DLL hijacking, enabling local code execution on industrial control systems. Attackers with local access can plant malicious libraries to compromise automation environments. CVSS 4.4 (Medium).
CVE-2026-31431 ("Copy Fail") allows local privilege escalation to root on ABB Edgenius gateways (CVSS 7.8). Containerized deployments risk container escapes enabling lateral movement into industrial systems.
Adobe released patches for 88 vulnerabilities, including eight critical ColdFusion flaws enabling code execution and privilege escalation. The Priority 1 update demands immediate deployment.
D1R claimed to breach Synopsys and Bosch but provided no evidence. The incident reflects a trend where threat actors use deception rather than actual breaches to extort ransom payments.
Microsoft released 622 vulnerabilities in July—a record—including two actively exploited zero-days: AD FS privilege escalation (CVE-2026-56155) and unauthenticated SharePoint RCE (CVE-2026-56164). Both enable rapid enterprise compromise and pose immediate critical risk to organizations worldwide.