ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
WorldLeaks stole 540K healthcare records from Centers Lab. Detection delays block industry-wide learning—supply chains are only as strong as their weakest vendor. (155 characters)
Progress ordered emergency shutdowns of ShareFile Storage Zone Controllers after discovering chained vulnerabilities (CVE-2026-2699, CVE-2026-2701) enabling unauthenticated remote code execution.
Zero-day file upload flaws in Balboola Forms and iCagenda Joomla extensions enable unauthenticated remote code execution. Both are actively exploited and on CISA's Known Exploited list.
A misconfigured server exposed three active Evilginx phishing operations targeting Microsoft 365. The discovery revealed harvested credentials, malware, and infrastructure for systematic MFA bypass.
CISA confirmed active exploitation of CVSS 10.0 zero-days in popular Joomla extensions iCagenda and Balboola, enabling unauthenticated remote code execution. Organizations must patch immediately or face near-certain compromise.
OpenAI lifted usage caps on GPT-5.6 Sol due to massive demand, removing the five-hour rolling limit for premium tiers. The move prioritizes user experience amid infrastructure strain.
OpenAI has temporarily relaxed usage limits on GPT-5.6 Sol to boost enterprise adoption, increasing throughput 3–5x for qualified users. The pilot tests real-world demand before permanent pricing changes.
Anthropic extended Claude Fable 5 free access to July 19, the second extension in a week. Rolling deadlines suggest real-time compute management rather than firm commitments.
RedHook malware weaponizes Android's Wireless ADB to gain shell access without rooting. Supporting 53 commands, it enables screen capture, data theft, and persistent remote control through social engineering alone.
Pakistani law enforcement faced a state-sponsored espionage campaign (2024-2026) from China and India-aligned groups exploiting Balochistan Police's portal to steal criminal records and citizen data. The breach represents a significant escalation in targeting South Asian law enforcement infrastructu
Jscrambler npm v8.14.0 was compromised with a Rust infostealer executing via preinstall hook. Socket.dev detected it within 6 minutes, preventing mass compromise of developer credentials and SSH keys.
Threat actors weaponize dormant GitHub accounts for reconnaissance and data theft, exploiting the open API. Over 50 'ghost accounts' conducted coordinated campaigns since October 2025.
ACSC warns of large-scale CMS campaign exploiting 16+ WordPress/Joomla vulnerabilities to deploy persistent webshells on Australian SMBs. Attackers gain backdoor access and steal credentials.
Ghostcommit exploits AI code reviewers by hiding prompt injection instructions inside PNG images to steal repository secrets like API keys and credentials undetected. The attack works because AI agents process images while human reviewers skip them, creating a dangerous supply chain vulnerability in
Zimbra stored XSS vulnerability lets attackers steal credentials and launch lateral attacks within enterprise networks via weaponized emails. Immediate patching and WAF deployment critical.
Six U-Boot bootloader flaws enable firmware malware injection before the OS loads, compromising millions of enterprise, IoT, and networking devices with nearly undetectable persistent attacks that bypass security features.
China and India-linked APT groups simultaneously targeted Pakistani police forces. This rare convergence reflects escalating state-sponsored cyber warfare in South Asia and vulnerabilities in critical government infrastructure.
Vishing campaign bypasses Microsoft 365 MFA through fake passkeys, compromising accounts in six industries. Okta's O-UNC-066 threat, active since April 2026, targets data extortion.
Jen Ellis spent 12 years advocating for legal protections for security researchers after a colleague faced prosecution for legitimate research in 2013. Her advocacy earned her an MBE recognition, transforming policy to shield cybersecurity researchers from unjust legal threats.
Governments globally mandate social media age restrictions, but platforms lack reliable age verification tech at scale. This creates an enforcement gap where laws exceed practical capabilities and may provide only false security rather than genuine child protection.
Cybercriminals are pivoting to target healthcare service providers over hospitals directly, with attacks on vendors and business associates more than doubling in 2026. By compromising less-protected third parties like billing and IT providers, attackers gain access to patient data and entire hospita
ScamBuster, an AI tool, responds to phishing emails with fake personas to extract attacker intelligence. It collects criminal network data without exposing real victims, helping organizations and law enforcement dismantle phishing operations.
Six U-Boot flaws affect billions of devices worldwide. Four enable denial-of-service attacks; two allow code injection at boot, giving attackers control before the OS loads.
Progress warned ShareFile customers to shut down Storage Zone Controllers due to a critical security threat. Affected accounts were disabled while investigating the undisclosed vulnerability.