ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Imprisoned money launderer Rossen Iossifov was charged with stealing $290,000 in seized cryptocurrency from his prison cell while already serving a 121-month sentence for fraud. The case underscores law enforcement's persistent challenges in securing digital assets and criminals' determination to re
Gitea Docker flaw (CVE-2026-20896) enables full account takeover via HTTP header injection. With 6,200+ instances exposed, attackers can steal code, modify repos, and access secrets without credentials.
Progress warned of a credible threat targeting ShareFile Storage Zone Controllers on July 9, ordering immediate server shutdowns. No breach confirmed yet, but the emergency response highlights escalating on-premises software vulnerabilities.
Dutch police linked domestic cybercriminals to Odido's February 2026 breach, exposing 6.2 million customers' personal data via social engineering. ShinyHunters claimed the attack, leaking names, addresses, phone numbers, IBANs, and ID details for millions of Dutch residents.
Karen Vardanyan, 34, pleaded guilty to deploying Ryuk ransomware against U.S. companies and faces 15 years prison plus $1.1M+ restitution. His conviction represents another major victory against the now-defunct syndicate that operated through mid-2020.
Ransomware negotiator Angelo Martino was sentenced to 70 months for supplying BlackCat ransomware operators with victim intelligence, becoming the third security insider prosecuted for aiding threat actors and exposing critical vulnerabilities in the cybersecurity industry.
Armenian ransomware affiliate Vardanyan pleaded guilty for $15M ransom attacks, ordered to pay $1.1M restitution. Canada's CSE disclosed active offensive cyber operations against criminal networks.
Countries are banning social media for minors citing mental health risks, but age verification may worsen privacy issues. Australia, Canada, and the UK lead despite industry pushback.
OpenClaw vulnerabilities allow WhatsApp-based host compromise through bind mount validation bypass. Attackers gain access to ~/.ssh, ~/.aws, and credential directories; patched in version 2026.6.6.
Researchers demonstrated a laser attack that resets Tangem wallet passwords, enabling complete account takeover. The flaw is unfixable because Tangem's firmware is intentionally immutable by design.
AI coding assistants boost productivity 35–55%, but security scanning overhead and false positives often erase those gains. Only 32% of organizations have calculated total cost of ownership when accounting for vulnerability remediation and developer retraining.
China-linked Silver Fox masks the sophisticated Rust RAT MODBEACON behind simple fake-software distribution, using encrypted gRPC for command control—a contrast revealing upgraded capabilities.
AI agents create unmanaged shadow identities with standing privileges and minimal oversight. Risks: invisible proliferation, privilege creep, compromise—leaving organizations blind to compliance.
O-UNC-066 uses vishing to trick users into enrolling malicious passkeys on Microsoft 365, gaining persistent phishing-resistant access. This weaponizes enhanced security against enterprises.
A security study of 281 free Android VPN apps with 2.4 billion downloads found critical flaws where some apps transmit unencrypted configuration files, allowing attackers to hijack encrypted tunnels. Billions of users unknowingly have compromised privacy while believing their traffic is protected.
Exposed server revealed WP-SHELLSTORM, targeting 1.4M WordPress sites for resale. Leaked data included exploit tools, C2 configs, and logs from one of the largest hacking operations discovered.
XQUIC's unpatched XRING flaw lets attackers crash HTTP/3 servers with just 260 bytes of legitimate traffic, requiring no authentication. Public exploit code exists, leaving production systems vulnerable since the 2022 disclosure.
Zimbra patched a critical stored XSS vulnerability in its Classic Web Client; malicious emails can steal session tokens and credentials. Russian state actors are actively exploiting the flaw.
HalluSquatting weaponizes AI hallucinations by registering fake packages that assistants invent with 85-100% reliability. Developers unknowingly install malicious code, granting attackers terminal access to compromise machines at scale.
GigaWiper is a modular Go-based backdoor combining espionage, encryption, and disk destruction in one toolkit. It enables persistent C&C access with flexible, on-demand payload deployment—representing a dangerous evolution in destructive malware tactics.
Ransomware negotiator Angelo Martino was sentenced to 70 months for leaking clients' insurance limits and negotiation strategies to BlackCat operators, enabling attackers to maximize ransom demands. His betrayal demonstrates how insider threats can amplify ransomware attacks and the risks of corrupt
A critical vulnerability in crypto wallet software allows attackers to drain funds by reverse-engineering recovery phrases due to weak randomness. Over $3.1 million has been stolen from 431 wallets.
Ransomware negotiator Angelo Martino was sentenced to 70 months for orchestrating BlackCat attacks, exploiting insider knowledge of victims' insurance policies and negotiation strategies to maximize extortion payouts alongside two other cybersecurity insiders.
A network of 200 GitHub repositories distributes Windows malware through Go modules, using public "dead drop" repos to stage payloads and evade detection in a sophisticated supply chain attack on developers.