ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure ACTIVE THREATS: CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor • Attackers Use Passkey Phishing to Hijack Microsoft Cloud Accounts and Exfiltrate Data • Orthanc DICOM Server • GitLab Vulnerability Exploited One Day After Disclosure
The full HackWire archive — 3,887 stories, newest first.
ClickFix is an industrialized social engineering attack that tricks users via fake pop-ups into executing malicious commands, evading traditional security controls by leveraging legitimate tools like PowerShell. Now available for rent to criminal actors, it represents one of the most pervasive threa
Illinois, New York, and California enact frontier AI disclosure laws effective January 2027. Developers must submit transparency reports before deploying models—the first major state-level AI regulation affecting the advanced AI sector.
Microsoft's record July 2026 Patch Tuesday includes 622 CVEs (3 zero-days, 2 actively exploited), driven by AI-assisted vulnerability discovery. The volume creates an unprecedented triage crisis, with organizations unable to comprehensively patch all vulnerabilities and forced to make strategic patc
Vendor failures cascade through supply chains; managing hundreds of interconnected dependencies while maintaining security visibility and governance at scale remains the core enterprise challenge.
Researchers found that 6 GHz Wi-Fi frequency coordination systems trust unverified client location and time data, potentially allowing attackers to spoof signals and disrupt critical cellular and emergency infrastructure. No active attacks documented, but fundamental architectural flaws need fixing
Microsoft released a record 622 patches including two actively exploited zero-days: CVE-2026-56164 in SharePoint and an AD FS flaw. Both enable unauthenticated privilege escalation in critical infrastructure.
Spanish authorities dismantled a €140M cyber fraud operation using business email compromise and investment scams, arresting 4 suspects across Spain, Portugal, and Panama. The operation seized €3M and identified 800+ fraudulent bank accounts with 67 money mules.
SonicWall SMA1000 appliances face active exploitation of two critical flaws: an unauthenticated SSRF and authenticated RCE. Federal agencies must patch by July 17, 2026, or discontinue use.
Microsoft released 570 patches in July—nearly 3× the prior month—driven by AI-accelerated vulnerability discovery, signaling that rapid patch cycles are now the norm. Three zero-days in Active Directory, SharePoint, and BitLocker are already exploited, making continuous patching mandatory for enterp
A vulnerability in Claude for Chrome allows malicious extensions to access Gmail, Google Docs, and Calendar without user consent by pivoting through Claude's connected services. The flaw represents a significant escalation in browser extension threats, creating an unauthorized bridge between extensi
SAP patched critical CVE-2026-44747 (CVSS 9.9) in NetWeaver ABAP—a memory corruption flaw allowing authenticated attackers to corrupt data, exfiltrate records, or maintain persistence on affected ERP systems.
Microsoft released KB5099539, patching 570 Windows 10 vulnerabilities including remote code execution and privilege escalation flaws. The massive patch cycle reflects ongoing security debt in the aging OS, now in extended support after its October 2025 mainstream support end.
~300 counterfeit GitHub repositories impersonate legitimate projects, deceiving developers into downloading infostealer malware. This supply chain attack harvests credentials, API keys, and sensitive data—a significant threat to the open-source ecosystem.
LabubaRAT is a Rust-based remote access trojan disguised as NVIDIA software. It uses adaptive security detection and runtime configuration to establish persistent attacker control over Windows systems.
Phishing targets LastPass and Bitwarden users via fake compliance emails using lookalike domains. Attackers aim to steal master credentials through impersonated DocuSign portals. No breach occurred, but the campaign's sophistication poses serious risks.
Progress confirmed a path traversal vulnerability in ShareFile Storage Zone Controllers (5.x/6.x) allowing authenticated admins to access sensitive files. No breaches confirmed. Patches released (5.12.5 and 6.0.2); immediate deployment urged.
Microsoft released critical Windows 11 updates patching 571 vulnerabilities across multiple products in this Patch Tuesday cycle. Beyond security fixes, the updates include Bluetooth enhancements and expanded Point-in-Time restore capabilities.
Microsoft patched 570 vulnerabilities in July 2026 Patch Tuesday, including 59 critical flaws and three zero-days (two actively exploited). The record-breaking update reflects AI-powered threat detection and the persistent risk landscape enterprises face.
A critical flaw in Claude for Chrome survives eight patches, allowing malicious extensions to access Gmail and calendars without consent. Two attacks—click injection and URL bypass—enable account hijacking.
Seven critical vulnerabilities in VMware Avi Load Balancer allow authentication bypass and remote code execution with root privileges. Broadcom released patches; immediate updates needed as no active exploitation has been reported yet.
Researchers reported the vulnerability to Cursor in December, but it still remains in the popular AI coding platform and can be exploited in poisoned repository attacks.
Attackers exploit OAuth client ID spoofing to validate stolen credentials against Microsoft Entra ID without detection. Two groups have compromised millions of accounts since December 2025.
Two RabbitMQ vulnerabilities enable broker compromise and data theft. CVE-2026-57219 exposes OAuth secrets via unauthenticated endpoint access, while CVE-2026-57221 bypasses authorization and breaches multi-tenant isolation.
A KU Leuven study found crypto wallet extensions leak identifying data, allowing address linking and cross-site tracking. Users' supposedly anonymous addresses are traceable to their real identity.