ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
AI gateways are vulnerable due to weak security. A cryptomining campaign exploited gateway weaknesses to access cloud infrastructure and credentials, exposing their critical trust boundary role.
AI-powered attacks now execute in minutes through automated phishing and reconnaissance. Traditional defenses designed for human-speed response can't keep pace with machine-speed exploitation.
Microsoft patched CVE-2026-50656, a race condition in Malware Protection Engine enabling local SYSTEM access. Publicly disclosed without workaround, it fully compromises antimalware protections.
GodDamn ransomware uses Microsoft-signed drivers to disable security before encrypting systems. The Hyadina collective's attack demonstrates kernel-level defense evasion targeting enterprises across industries.
AI-driven vulnerability discovery is overwhelming open source. New clearinghouses automate remediation for obscure dependencies, where vulnerabilities pose equal risks despite low visibility.
INTERPOL's Operation First Light 2026 arrested 5,811 suspects across 97 countries, seized $293M, and identified 142,000 fraud victims in an unprecedented coordinated global anti-fraud crackdown.
Microsoft is retiring OWA Light in August 2026 after nearly 20 years. Exchange admins must migrate users to modern Outlook on the Web before the deadline to reduce legacy attack surface and simplify infrastructure.
GhostApproval tricks AI assistants into editing system files via symlinks while showing false approval paths, bypassing security checks. This enables remote code execution and supply-chain attacks on developers.
Chrome 150 patches 27 vulnerabilities including high-severity flaws enabling remote code execution and sandbox escapes. Users should update immediately as Chrome's 3 billion users make it a prime attack target for threat actors.
Spanish identity startup 8Layers raised $2.9M in pre-seed eight weeks after launch. The funding signals strong market demand for credential protection amid account takeover attacks.
Dangerous gap: 73% of European security leaders believe their collaboration tools are secure, yet fewer than 40% have DLP controls and 62% lack visibility into channel access—leaving sensitive corporate data significantly exposed to risk.
Meta's Muse AI automatically feeds public Instagram photos into its image generation model by default, without user opt-in consent, enabling the platform to reference people's faces and personal posts as AI training material. The feature raises privacy concerns about how tech giants exploit user-gen
AssuranceAmerica disclosed a breach exposing 6.9 million drivers' personal data including SSNs, license numbers, addresses, and VINs—one of the largest insurance sector breaches in years. Discovered during an internal security audit, the company is offering credit monitoring, though experts warn the
A hardcoded backdoor in Tenda firmware (CVE-2026-11405) exposes millions of routers to unauthorized admin access using any username with a fixed password. No patch exists, leaving hundreds of thousands of devices in enterprise and consumer environments completely vulnerable.
China-based Lurking Lizard operates a residential proxy botnet using trojanized software (like fake 7-Zip) to compromise 773K+ devices worldwide, routing third-party traffic through victims' machines for profit. The scheme leverages 230+ lookalike domains and counterfeit app stores to recruit endpoi
GhostApproval affects six AI coding assistants, including Claude Code. It exploits symlinks and broken approval dialogs to inject SSH keys into sensitive files, enabling account hijacking.
"Friendly Fire" attacks deceive AI agents into running malware hidden in README files. Claude Code and Codex autonomously execute attacker payloads during security audits, exploiting workflow design vulnerabilities rather than code bugs.
Microsoft patched CVE-2026-50656 (RoguePlanet), a Windows Defender zero-day enabling SYSTEM privilege escalation on fully patched Windows 10/11. Researcher Nightmare Eclipse's disclosure sparked tensions with Microsoft over bug bounty policies and legal threats.
JadePuffer is the first autonomous AI ransomware requiring minimal human oversight. It performs reconnaissance, exploitation, and encryption while adapting to defenses—a new era of AI-enabled cybercrime.
Mexico's cybersecurity plan faces trial by fire hosting FIFA 2026, when the tournament becomes a magnet for ransomware, hacktivists, and disinformation. How the nation responds will shape its security credibility globally.
Agentic AI enabled attacker to compromise AWS and extort customer in 72 hours through autonomous reconnaissance, escalation, and persistence—a significant escalation in threat techniques.
Ransomware gang CMD breached Mount Royal University, demanding $1.9M and stealing personal data including passports, IDs, employment records, and financial information from thousands of students and staff.
HalluSquatting exploits AI assistants' false package suggestions to spread malware through typosquatting. Developers must validate dependencies while platforms strengthen AI safety controls to prevent this emerging threat.
China-linked hackers exploit Roundcube vulnerabilities at North American universities. They steal researcher credentials and establish backdoors to infiltrate sensitive research networks, part of a broader intelligence-gathering operation.