ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Operation Navy Ghost compromised eight PyPI packages since November 2025 with 25,000+ downloads. The trojanized Pyrogram forks contain backdoors giving attackers complete Telegram bot control.
Microsoft set a 2029 deadline for quantum-safe encryption on critical systems, responding to "harvest now, decrypt later" attacks where adversaries collect encrypted data now for future decryption. State-sponsored actors and criminal groups are already executing this strategy, stealing encrypted dat
Hospitality firms face coordinated phishing attacks leveraging malicious ZIP files and blockchain obfuscation to access reservation systems and guest data across Europe and Asia. Attackers use social engineering to trick employees into extracting malware that establishes persistent network access.
Identity security is emerging as cybersecurity's most accessible entry point; 70% of breaches involve identity compromise. Hybrid work and cloud adoption have created critical demand for identity security professionals.
RustDuck, a Rust-based botnet, hijacks unpatched IoT devices for DDoS attacks. The malware highlights enduring vulnerabilities in routers, cameras, and media boxes that persist despite industry warnings.
Poisoned AI tool descriptions trick agents into silently leaking sensitive data. Attackers exploit tool metadata interpretation to bypass security controls.
"Silent Swap" is a malicious browser extension that steals cryptocurrency by silently replacing wallet addresses with attacker-controlled ones. It intercepts clipboard operations without visible indication, redirecting transactions to the thief's wallet while victims unknowingly send funds.
Schneider Electric RTUs expose hardcoded credentials allowing attackers to compromise critical infrastructure globally. Physical access or network-based extraction enables SCADA control in power, water, and manufacturing systems.
Supreme Court ruled 6-3 that cellphone location data gets Fourth Amendment protection, rejecting the 'third-party doctrine.' The landmark decision reshapes how police obtain digital evidence.
Chris Thompson transitioned from hacking game servers as a teenager to founding IBM X-Force Red. His unconventional journey—rooted in curiosity and rule-breaking—demonstrates how offensive security skills convert into legitimate enterprise defense expertise.
Threat actors exploit critical Langflow RCE (CVE-2026-33017, CVSS 9.3) to deploy Monero cryptominers on enterprise networks. The attack chain features lateral movement via SSH credential reuse, log wiping, and persistence hardening to maintain exclusive access.
A fake Perplexity extension on the Chrome Web Store hijacked search queries and tracked browsing data through attacker infrastructure, Microsoft Threat Intelligence discovered. The impostor used deceptive branding to intercept user searches and collect telemetry before routing them through malicious
Aflac Japan disclosed a 4.38M customer breach during a 10-day intrusion (June 15-25), exposing names, addresses, policy numbers, and banking details for ~230k customers. Attackers didn't access credit card numbers. The incident is isolated to Japan operations.
AI coding agents are vulnerable to "GuardFall," a shell obfuscation bypass that lets attackers steal credentials and alter code. The flaw affects 10 of 11 tested agents and exploits their tendency to run with full developer permissions, creating a dangerous supply chain attack vector.
Wake Forest researchers audited 444 iOS AI chatbot apps and found 282 leaking API credentials through plaintext or unprotected backends, exposing developers to unauthorized charges and hijacking.
GuardFall exploits how AI coding agents scan commands as plain text while bash interprets shell syntax. This mismatch lets attackers use metacharacters like empty quotes to execute dangerous commands undetected, potentially compromising entire development systems.
BEC exploits human trust through executive impersonation to trick employees into fund transfers or data theft. These undetected attacks rank among the costliest cyber threats.
BlueHammer (CVE-2026-33825) is a Microsoft Defender flaw allowing privilege escalation. Exploited for 8 days pre-patch, multiple ransomware groups used it to disable security and deploy payloads.
NIST reduced CVE enrichment analysis to streamline resources, creating gaps in vulnerability coverage. While critical vulnerabilities now process faster, organizations lack complete data for risk prioritization.
AI-generated workflows function perfectly while embedding exploitable security flaws—overprivileged access, credential exposure, unvalidated data—invisible to traditional security tools. Teams assume correct output means secure process, creating blind spots in production systems.
Six vulnerabilities in AirDrop and Quick Share allow nearby attackers to crash services and bypass security prompts without user interaction, using only a laptop within wireless range.
Cybercriminals pre-deployed fraud infrastructure targeting FIFA 2026 before the tournament opened. The scheme uses phishing, malware, and payment fraud against fans and ticketing platforms across multiple sectors and languages.
SimpleHelp vulnerability CVE-2026-48558 enables attackers to bypass authentication and gain admin access to managed systems. Active exploits use TaskWeaver and Djinn Stealer malware to compromise infrastructure and steal credentials.
Blackfield gang demands $2M from Nidec Corp after compromising its Taiwanese subsidiary—the second attack in 8 months. The breach threatens global supply chains for automotive, computing, and industrial motors.