ACTIVE THREATS: How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor ACTIVE THREATS: How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know • AVEVA Pipeline Integrity Monitor
The full HackWire archive — 3,891 stories, newest first.
A trusted OpenMandriva contributor exploited admin privileges to delete core repositories and publish poisoned packages, sabotaging the Linux distribution. The attack exposed critical governance gaps in how open-source projects manage access control and handle internal disputes.
Phishing campaigns impersonating Netflix, Adobe, and OpenAI target job seekers to steal Google credentials. Compromised accounts unlock email, cloud storage, and connected services across personal and corporate networks.
Microsoft patched CVE-2026-50656, a Windows Defender flaw enabling privilege escalation to SYSTEM access. Disclosed by researcher Nightmare-Eclipse, it fuels disputes over coordinated vulnerability disclosure practices.
Iranian cyber groups Handala and Ababil have abandoned targeting only critical infrastructure, now opportunistically attacking any vulnerable organization—logistics firms, law firms, medical manufacturers. These actors exploit exposed internet-facing systems for profit and espionage while maintainin
Attackers compromised Injective Labs' GitHub and injected wallet-stealing malware into @injectivelabs/sdk-ts on npm. It affected 310+ downloads, impacting thousands of developers.
Schneider Electric MiCOM Px40 relays contain hard-coded SNMP credentials, enabling device fingerprinting (CVE-2026-4832). This medium-severity flaw allows attackers to map critical grid infrastructure.
**Summary:** CVE-2026-14480 in OpenPLC v3 allows authenticated attackers to achieve RCE via improper file validation in the web UI, enabling injection of malicious C++ code into the runtime. Affects critical infrastructure globally with CVSS 9.9 severity. (195 characters, 2 sentences)
Six critical vulnerabilities in Schneider Electric's PowerChute UPS software enable attackers to overwrite files, reset credentials, and disrupt power systems on hospitals, data centers, and industrial facilities. CVSS 6.1 requires urgent patching.
GigaWiper is a modular Windows backdoor offering disk wiping, drive overwriting, and fake ransomware—selectable post-deployment. Unlike traditional ransomware, it's purely destructive with no recovery path.
Attackers use dormant GitHub accounts and compromised tokens to map corporate repositories undetected. Ghost accounts with clean histories bypass security alerts, enabling stealthy reconnaissance of organizational infrastructure.
Admin oversights—weak validation and reused credentials—caused this week's breaches, not sophisticated tactics. INTERPOL arrested 5,811 fraudsters and recovered $293M, proving operational discipline defeats breaches better than technical sophistication.
npm 12 disables install scripts by default, requiring developers to explicitly approve their execution. This shift from "trust by default" prevents supply chain attacks where malicious code automatically runs during package installation, complemented by restrictions on granular access tokens bypassi
Microsoft is using MDASH, an AI system, to rapidly identify Windows vulnerabilities at scale. Human engineers still review and validate all findings before patches are released.
Helix exploits SharePoint via voice phishing with spoofed caller IDs to impersonate managers, harvesting credentials to exfiltrate data and extort victims like Medtronic, Nissan, and NAIC.
Palo Alto Networks patched 13 vulnerabilities including authentication bypass and RCE risks in Panorama and PAN-OS. Organizations must prioritize patching to close attack vectors.
The UK's Cyber Shield deploys agentic AI to match attackers who compress cyber exploits from weeks to minutes. It aims for machine-speed defense against predicted fully autonomous attacks.
Israeli startup QIZ Security raised $17M in seed funding to address post-quantum cryptography governance across enterprises. The platform helps organizations discover, inventory, and remediate encryption vulnerabilities as they transition to quantum-resistant standards.
NotPetya, a Russian cyberweapon, spread globally via a poisoned Ukrainian tax software update, causing $10B+ damages across 80+ countries. It indiscriminately hit major firms like Maersk and Merck.
Cyberattacks spike 40% during summer vacations as skeleton IT crews reduce security capacity. AI-enhanced threats exploit staffing gaps and slower threat detection, making 2026's seasonal window particularly dangerous for unprepared organizations.
Forg365 targets Microsoft 365 users with AI-generated phishing lures and credential theft. Discovered by ZeroBEC, it represents a major escalation in phishing-as-a-service sophistication.
GhostLock, a Linux kernel flaw hidden for 15 years, lets attackers gain root access on billions of systems. The vulnerability affects all major distributions and risks cloud platforms.
KDDI, Japan's largest telco, exposed 12M customers via zero-day in third-party email system. The breach compromised customer data and highlights supply chain security risks.
GodDamn ransomware exploits Microsoft-signed drivers to disable security software before encrypting networks. This BYOVD technique represents an alarming escalation, weaponizing legitimate software to evade enterprise defenses.
AI gateways are vulnerable due to weak security. A cryptomining campaign exploited gateway weaknesses to access cloud infrastructure and credentials, exposing their critical trust boundary role.