ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
CISA warned of four critical vulnerabilities (CVSS 10.0) under active exploitation as of July 8. Attackers are targeting AI platform Langflow to steal LLM provider and AWS credentials. Adobe ColdFusion, JoomShaper, Joomla, and WordPress are actively being exploited with minimal delay after disclosur
GhostLock (CVE-2026-43499) is a 15-year-old Linux kernel flaw allowing any local user root access in seconds. Publicly exploited and inconsistently patched, major distros remain vulnerable.
Two suspects arrested for a Dutch phishing operation that stole credit card data from victims. The arrests underscore the Netherlands' ongoing struggle with Europe's highest payment fraud rate.
Threat actor '888' publicly offered 35GB of stolen Accenture source code, cryptographic keys, and credentials for sale. Accenture downplayed the incident despite it being the company's third major breach in five years.
Digi PortServer devices face critical vulnerabilities allowing unauthenticated access (CVE-2026-12352) and stored XSS injection (CVE-2026-12948), threatening manufacturing and critical infrastructure worldwide. Together they enable attackers to bypass security entirely, inject malicious scripts into
PROMOD V (CVE-2026-10763) uses unencrypted HTTP, exposing power grid credentials and commands to network interception. The HIGH-severity flaw threatens critical energy infrastructure operations globally.
Three critical memory corruption vulnerabilities in Labcenter Proteus enable arbitrary code execution through malicious design files. Widely used in critical infrastructure sectors—power grids, telecom, medical devices—compromised designs could inject malicious code into hardware at the CAD stage; C
A critical flaw in Google Dialogflow CX, dubbed "Rogue Agent," allows attackers with basic update permissions to inject malicious code into chatbots, exfiltrate customer conversations, and steal credentials by exploiting insufficient permission validation. The vulnerability has been patched by Googl
Targeted phishing campaign impersonates major brands (Coca-Cola, Netflix, McKinsey) to trick marketing professionals with fake job offers, using nested redirects through legitimate platforms to steal Google credentials. Attackers personalize emails with target names and professional details to incre
A critical NGINX buffer overflow (CVE-2026-42945) in Hitachi Energy's e-mesh EMS exposes power grids to denial of service and code execution attacks via specially crafted HTTP requests. Legacy energy systems without ASLR protections face heightened risk of exploitation.
CVE-2026-20896 in Gitea allows authentication bypass via HTTP header manipulation, giving attackers access to private repositories and credentials. Active exploitation is confirmed in the wild, posing immediate risk to organizations using self-hosted Gitea instances.
An Ohio county paid $1 million to prevent leaked stolen data in a data-theft extortion attack. The growing threat targets resource-strapped local governments nationwide.
Armored Likho deployed BusySnake infostealer against critical infrastructure in Russia, Brazil, and Kazakhstan to steal credentials and maintain persistent access. The modular malware targets government agencies and electrical power networks, representing a significant escalation from the group's ea
Chinese APT UAT-7810 uses LONGLEASH malware on Ruckus routers to build persistent C2 relay nodes. The firmware backdoor enables network interception and lateral movement in North America and Europe.
GitLost is a prompt injection vulnerability in GitHub Agentic Workflows that lets unauthenticated attackers extract sensitive code from private repos using crafted GitHub issues. It highlights the security risks of deploying AI agents with broad repository access and demonstrates how untrusted input
DEBULL attacks exploit device-code phishing to bypass MFA and hijack Microsoft 365 accounts. The campaign abuses Microsoft's OAuth 2.0 flow, needing no passwords or traditional MFA compromise.
Google Dialogflow CX had a critical flaw enabling attackers to hijack enterprise chatbots and steal conversations. The "Rogue Agent" vulnerability has been patched with no exploits detected.
RedWing is a Telegram-based Android malware service automating banking fraud with subscription tiers and fake app stores. Operating like legitimate SaaS, it democratizes mobile bank attacks, making sophisticated fraud accessible to non-technical criminals globally.
A critical backdoor (CVE-2026-11405) in Tenda routers grants attackers full admin access via a hidden password. The vendor is unreachable for a fix, leaving millions of devices vulnerable.
CVE-2026-53359 (Januscape) is a 16-year-old KVM vulnerability enabling VM escape on Intel/AMD clouds. The use-after-free flaw lets attackers execute root code on hosts, compromising all tenant VMs.
Tarah Wheeler, CISO at TPO Group, stumbled into cybersecurity through social science rather than coding. Her key insight: security failures are fundamentally human failures, not just technical ones.
GitLost exploits GitHub Agentic Workflows via prompt injection to leak private repository contents through public issues. Attackers embed hidden instructions that trick AI agents into posting sensitive data publicly, bypassing GitHub's safeguards with simple linguistic tricks.
Cordyceps exploits GitHub Actions workflow chains to compromise projects with a PR. Security scanners miss this because they analyze individual files, not chains.
Spain arrested a pro-Russian CARR member targeting US and European critical infrastructure. The raid seized computers and cryptocurrency, escalating international enforcement against hacktivists.