🟢ToolsMEDIUM
Kali Linux 2026.2 released with 9 new tools, NetHunter updates
Kali Linux 2026.2 adds 9 new security tools and revamps NetHunter for Android pentesting. Boot times improve 70%, with GNOME 50 and Linux kernel 6.19.
All Stories
The full HackWire archive — 3,892 stories, newest first.
🔵PolicyMEDIUM
Microsoft adds smarter bot protection to Teams meetings
Microsoft adds bot security to Teams requiring organizer approval. The default-deny policy blocks unauthorized bots from impersonating staff and stealing credentials.
🔴BreachesHIGH
Insurance giant Aflac discloses data breach after subsidiary hack
Aflac Japan disclosed its second major data breach in 12 months, with unauthorized actors accessing customer personal information, bank account details, and policy data during an 11-day window in mid-June 2026. The company contained the breach upon discovery and confirmed U.S. operations were unaffe
🟡VulnerabilitiesCRITICAL
Critical SimpleHelp Vulnerability Exploited for Malware Delivery
SimpleHelp's OIDC bypass (CVE-2026-48558) allows unauthenticated access via forged tokens. Exploited to deploy Djinn Stealer malware targeting developer credentials across managed systems.
🔴BreachesCRITICAL
Nissan Employee Data Breached in Oracle PeopleSoft Hack
Nissan was breached via a zero-day in Oracle PeopleSoft (CVE-2026-35273) affecting 100+ organizations. ShinyHunters stole employee SSNs, banking data, and tax records across the Americas.
🟡VulnerabilitiesCRITICAL
Progress Kemp LoadMaster Flaw Could Let Attackers Run Root Commands Pre-Auth
Kemp LoadMaster contains a critical pre-auth RCE flaw (CVSS 9.8) enabling unauthenticated root access via a broken input sanitization function. With a public PoC available, thousands of organizations must patch urgently.
🔴BreachesCRITICAL
New BioShocking Attack Tricks AI Browsers Into Leaking User Credentials
A "BioShocking" attack uses indirect prompt injection to trick AI browser agents into stealing credentials by disguising malicious commands as game rules. Six major AI browsers including ChatGPT proved vulnerable, exposing critical risks in autonomous agent mode.
🟡VulnerabilitiesHIGH
CISA: Windows BlueHammer flaw now exploited by ransomware gangs
Ransomware operators exploit BlueHammer (CVE-2026-33825), a Windows Defender flaw enabling escalation to SYSTEM access. CISA confirmed active exploitation in campaigns, requiring immediate patching.
🟡VulnerabilitiesMEDIUM
Quantifind Raises $200 Million for AI-Native Risk Intelligence
Quantifind closed a $200M funding round to expand its AI-native financial crime prevention platform globally. The funding reflects growing demand for advanced solutions to combat money laundering and sanctions evasion.
🟡VulnerabilitiesCRITICAL
Apple Patches 30+ iOS, macOS, Safari Flaws, Including AI-Discovered WebKit Bugs
Apple released emergency patches for 30+ vulnerabilities, including four critical WebKit flaws discovered via AI tools. The memory corruption bugs enable remote code execution through malicious websites on iOS and macOS.
🔴BreachesCRITICAL
New Controller Flaws Expose Highway Signs and Billboards to Remote Hacking
Critical vulnerabilities in Daktronics display controllers allow remote hijacking of highway signs and billboards. Attackers could gain root-level access to systems affecting millions worldwide.
🟡VulnerabilitiesCRITICAL
Oracle E-Business Suite Flaw CVE-2026-46817 Actively Exploited in the Wild
Oracle Payments faces critical exploitation: CVE-2026-46817 allows unauthenticated remote control via HTTP. Actively exploited just 30 days post-patch, threatening thousands of enterprise deployments.
🟡VulnerabilitiesHIGH
'Djinn' Stealer Targets Cloud, AI Credentials
A SimpleHelp RMM vulnerability enables Djinn Stealer deployment targeting developer credentials and cloud infrastructure. The attack chain demonstrates modern supply chain exploitation methods.
🟡VulnerabilitiesCRITICAL
Horner Automation Cscape
Critical flaw in Horner Automation Cscape (CVE-2026-12897) allows code execution when opening malicious CSP files, risking manufacturing control systems. Requires local access but poses significant threat to environments with external consultants or remote workers. Patch available in version 10.2 SP
🔴BreachesCRITICAL
Yokogawa FAST/TOOLS and CI Server
Yokogawa exposed CVE-2026-11833, allowing unauthenticated attackers to steal configurations from industrial control systems via cleartext transmission, potentially enabling attacks on critical manufacturing and energy infrastructure.
🔵PolicyCRITICAL
Vulnerabilities Expose Private Data in Indian Government Systems
Researcher Sushant Bhardwaj uncovered 14 vulnerabilities in Indian government portals exposing millions of citizens' sensitive data, including bank accounts and addresses. The critical flaws stemmed from inadequate server-side access controls, allowing unauthorized access to records across education
🔴BreachesCRITICAL
NAIC says public data stolen in ShinyHunters' PeopleSoft breach
NAIC contradicts ShinyHunters' theft claims following a PeopleSoft zero-day breach. The hackers exploited the vulnerability across 100+ organizations and leaked NAIC data after failed ransom demands.
🔴BreachesCRITICAL
Nissan discloses employee data breach linked to Oracle zero-day attacks
Nissan suffered a breach via Oracle PeopleSoft zero-day, exposing employee SSNs and banking data. ShinyHunters compromised 300+ instances, expanding attacks to enterprise HR systems from education.
🟡VulnerabilitiesCRITICAL
Amazon Q VS Extension Flaw Leads to Cloud Credential Theft
Amazon Q's VS Code extension has a critical flaw enabling credential theft through malicious repositories. MCP integration allows arbitrary code execution with low attack complexity.
🔴BreachesCRITICAL
Iran, Russia, China Target Water Systems for Sabotage
Iran, Russia, and China-linked nation-state attackers are breaching water utilities by exploiting basic security lapses—weak passwords, misconfigured networks, exposed controllers—rather than sophisticated exploits. Water systems have historically lacked cybersecurity investment and been underestima
🟡VulnerabilitiesMEDIUM
Can Clothes Make You Invisible to Facial Recognition?
Adversarial patterns on clothing fool facial recognition AI with 60-90% accuracy in lab tests. Experts warn that real-world effectiveness is limited by deployment challenges and advancing defenses.
🟡VulnerabilitiesMEDIUM
Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input
A malicious Perplexity Chrome extension logged searches and keystrokes, routing data to attackers. It appeared normal to users. Microsoft detected it; Google removed it from the Web Store.
🟡VulnerabilitiesCRITICAL
Microsoft extends Windows Server 2022 hotpatching until October 2027
Microsoft extended Windows Server 2022 hotpatching support to October 2027, giving enterprises two additional years to deploy critical security patches without reboots. This addresses the operational complexity of managing large-scale server deployments and aligns with industry trends toward zero-do
🟡VulnerabilitiesMEDIUM
WhatsApp Rolling Out Username Feature to Bolster Phone Number Privacy
WhatsApp launches usernames to hide phone numbers from new contacts, addressing privacy concerns. The optional-credential feature won't appear in public directories—usernames must be directly shared to enable messaging.