ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Cybercriminals orchestrated a multi-platform campaign using fake credibility networks across GitHub, SourceForge, and YouTube to distribute a sophisticated clipboard hijacker that replaces cryptocurrency wallet addresses with attacker-controlled ones. The RUST-based malware targets Windows and macOS
DifyTap flaws in Dify AI platform allow unauthenticated attackers to steal other customers' conversations and documents. Attackers can silently exfiltrate data via persistent logging channels.
Three ShapedPlugin WordPress Pro plugins were backdoored via supply chain compromise, injecting malware that activates as hidden plugins and contacts a C&C server. Free versions remain unaffected, only Pro builds distributed through ShapedPlugin's infrastructure were weaponized.
Microsoft patched AutoJack, a critical vulnerability chain in AutoGen Studio that could enable arbitrary code execution when AI agents visit malicious websites. The flaw—fixed before official release—highlights emerging security blind spots in rapidly evolving AI development tools.
Windows 11 26H2 launches this fall via lightweight enablement packages instead of full downloads. The shared servicing model enables quick upgrades for 24H2 and 25H2 users, as all three versions share the same codebase and testing infrastructure.
Usbliter8 is an unpatchable hardware flaw in iPhone XS/XR/11 allowing USB attacks to bypass secure boot protections. Affected devices cannot be fixed with software updates—only hardware replacement.
Squidbleed exposes cleartext HTTP credentials in Squid proxy through a 1997 FTP parser bug. Authenticated attackers craft malicious FTP responses to leak auth tokens from memory buffers.
Threat actors now offer searchable "credential broker" services where buyers query vast stolen databases for specific targets. This on-demand model—positioning criminals as intermediaries—represents a dangerous maturation of the account takeover ecosystem, reducing barriers to entry for attackers se
Squidbleed, a decade-old memory disclosure flaw in Squid Proxy, allows attackers to leak sensitive data like credentials and session tokens from server memory. The vulnerability affects widely-deployed caching proxy software globally, similar to the 2014 Heartbleed attack.
Novo Nordisk's GitHub token leak exposed source code and CI/CD pipelines. It highlights a critical gap: organizations invest in secrets tools but neglect basic access governance.
Starting Sept 30, 2026, Google enforces developer identity verification in Brazil, Indonesia, Singapore, and Thailand, blocking unverified Android app installations to combat fraud and malware.
A Russian-speaking threat actor group is using malicious Google Ads to deliver CastleStealer credential-stealing malware via OXLOADER loader, exploiting ad platform legitimacy to target users across industries. The sophisticated campaign enables identity theft and account compromise by harvesting br
Canada's spy agency won a landmark warrant to actively disinfect botnet-infected computers nationwide without device owner consent, targeting millions of silent infections exploited by criminals.
Groups like ShinyHunters are demonstrating that attackers do not necessarily need malware or zero-day exploits to cause massive damage. The post What the Latest ShinyHunters Breaches Reveal About Modern Cyberattacks appeared first on SecurityWeek.
A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions. The post North Korean Hackers Blamed for Mastra NPM Supply Chain Attack appeared first on SecurityWeek.
Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data. The post Attackers Exploit Gravity SMTP Plugin Flaw to Harvest Valuable WordPress Data appeared first on SecurityWeek.
It’s Monday again. This week’s threat list looks painfully familiar: abused integrations, fake tools, poisoned websites, ransomware crews trying to shut down security tools, and mobile malware asking for way too much control. The annoying part is how little of this feels new. Weak credentials, sketc
Earlier this month, I spoke at the Gartner Security & Risk Management Summit about a blind spot most security programs are still not accounting for - how attackers are circumventing AI security programs by using legacy infrastructure to hijack AI agents. AI adoption is moving faster than securit
HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers. The post More Cybersecurity Firms Disclose Impact From Klue Hack appeared first on SecurityWeek.
A new malware family is turning forgotten home routers into a distributed reconnaissance and proxy network, not the DDoS botnet these devices usually end up in. QiAnXin's XLab calls it AryStinger and counts at least 4,300 infected routers, a total it says is still rising. The distinction m
Hackers stole personal information after breaching the systems of a third-party license vendor serving TPWD. The post Texas Parks & Wildlife Data Breach Affects 3 Million Individuals appeared first on SecurityWeek.
A new report from INTERPOL has revealed a "dramatic increase" in cybercrime in Asia and the South Pacific, fueled by rapid digitalization, internet penetration, new technologies, organized criminal networks, and a disparity in cybersecurity maturity. According to INTERPOL's 2025/2026 Asia and South
A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated routers to turn them into proxies for malicious traffic. [...]
A new ransomware operation named 'Prinz Eugen' prioritizes recently modified files for encryption and leaves no ransom note on the system. [...]