ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Google introduces granular privacy controls for Search while simultaneously expanding tracking to explicitly capture and save media—including images, audio, and video—for personalization and AI training, presenting what it frames as a privacy improvement while collecting more data.
The 2026 FIFA World Cup in North America faces escalating cyber threats from phishing, ransomware, ticketing fraud, and DDoS attacks targeting fan accounts, staff, and tournament infrastructure across three nations. Cybercriminals and nation-state actors are exploiting the event's massive attack sur
**Edgecution** abuses the Chrome Native Messaging API to bypass browser sandboxes and deploy a Python backdoor, enabling full system compromise. This malicious Edge extension, linked to the Payouts Kings ransomware gang, represents a sophisticated new attack vector targeting enterprises through the
Four chained vulnerabilities (CVSS 8.8) in Siemens SINEC INS enable remote code execution on industrial security gateways across manufacturing, energy, healthcare, and government sectors. Authenticated attackers can escalate privileges and achieve complete system compromise.
Attackers manipulate autonomous AI agents by poisoning trusted data sources with hidden instructions. Bypassing traditional security, these attacks succeeded 57% of the time in controlled tests.
Five malicious OpenClaw skills exploited ClawHub's weak vetting to steal credentials and evade detection. The incident highlights critical supply chain vulnerabilities in AI agent marketplaces.
International agencies dismantled Amadey and StealC malware networks. The operation recovered 27M credentials, restricted $47M in crypto, and disrupted ransomware and fraud infrastructure.
CISA warns of active exploitation in Lantronix and Ubiquity infrastructure devices. Both flaws allow unauthenticated root access, enabling network compromise. Federal agencies must patch by June 26, 2026.
Service desks remain targets because helping users conflicts with verifying identity. Attackers exploit this with reconnaissance and pressure to steal credentials, a gap training hasn't closed.
CISA's TIC 3.0 shifts federal agencies to zero trust security with SASE, validating every user and device. This modernizes defenses for 100+ agencies adapting to distributed workforces and threats.
CVSS scores fail for autonomous systems—a low-score sensor flaw poses more risk than critical backend RCE. AIVEX adds consequence context to fix vulnerability prioritization.
Microsoft and allies dismantled Amadey/StealC malware infrastructure, disrupting 385K+ systems and $47M in crypto. This represents a shift toward targeting entire cybercrime supply chains rather than individual threats.
Operation Endgame shut down Amadey and StealC malware by seizing 326 servers and 142 domains used to compromise hundreds of thousands of devices in a coordinated international law enforcement action.
CISA ordered emergency patching for actively exploited critical Ubiquiti and Lantronix flaws enabling remote code execution and command injection. Working public exploits are already available.
Ubiquiti devices face critical unauthenticated vulnerabilities affecting millions globally. Attackers can execute commands, hijack accounts, and modify configurations remotely.
Federal court sentenced Nathan Austad to 18 months in prison for DraftKings hacking—the third prosecution in the case. The 2018-2019 breaches exposed millions of users' personal data, with $1.8 million in forfeiture and restitution ordered.
A macOS attack chain lets unprivileged users silently disable endpoint security agents by chaining legitimate OS behaviors. This weaponizes standard functionality to evade enterprise defenses without requiring admin access, creating a critical blind spot in Mac security deployments.
Autonomous AI attackers now exploit vulnerabilities in hours, not weeks. The traditional patch-deployment timeline that guided cybersecurity for two decades is fundamentally broken.
Cordyceps vulnerabilities in GitHub Actions affect 300+ repos at tech giants like Microsoft and Google. Attackers could hijack CI/CD pipelines to inject malicious code into releases and compromise the open-source software supply chain.
Klue's competitive intelligence platform was breached through compromised legacy credentials, exposing OAuth tokens that gave attackers access to connected Salesforce instances at 15+ companies including LastPass and BeyondTrust in a cascade supply-chain attack.
Cordyceps lets unauthenticated attackers hijack CI/CD workflows in 300+ repos to steal credentials and inject malicious code. The flaw: workflows are treated as configuration rather than security code.
Mistic RAT, deployed by access broker Woodgnat, enables six major ransomware families. Using DLL sideloading, it establishes persistence for reconnaissance and lateral movement before ransomware deployment.
A macOS vulnerability allows standard users to disable enterprise security tools like EDR and MDM without admin credentials by impersonating trusted applications through CDHash spoofing—no kernel exploits or audit trails required.
Mistic, a custom backdoor by KongTuke, has compromised networks since April 2026. Used by major ransomware gangs, it reflects the shift to purpose-built tools, making detection harder.