ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Researchers demonstrated that Claude can adapt ICS exploits across different PLC models, dramatically lowering the technical barrier for weaponizing pre-authentication RCE attacks. This threatens critical infrastructure like power grids and water treatment plants that lack protection against widespr
SonicWall confirmed active zero-day exploitation of SMA1000 VPN appliances targeting enterprises. Attackers in the wild now control perimeter access for affected organizations.
Sality, a resilient 20-year-old P2P botnet, was finally taken down on August 31, 2026 when law enforcement weaponized its own peer network against itself through peer poisoning techniques.
An unauthenticated SQL injection in Sangoma Switchvox (CVE-2026-9586, CVSS 9.3) enables remote code execution and is actively exploited in the wild. SMB deployments with exposed interfaces risk complete host compromise and lateral movement into corporate networks.
Threat actors phish victims to deploy ScreenConnect through Faronics Deploy—both legitimate tools pre-approved by IT departments. This turns trusted software into persistent backdoors that evade detection.
Sality, a 23-year-old P2P botnet, was taken down by coordinated law enforcement. Its decentralized design made it resilient to past attempts, but it's unclear if this takedown is permanent.
Attackers manipulated BGP routing to intercept Virtualizor VPS management software updates, redirecting traffic to malicious servers and delivering malware as legitimate patches. This routing-layer attack bypassed traditional security boundaries, requiring no repository compromise or vendor infiltra
JFrog Artifactory's critical authentication bypass (CVE-2026-82329) allows unauthenticated attackers to mint admin tokens and inject malicious packages into software repositories. Actively exploited in the wild, the flaw poses severe supply chain compromise risks across enterprises relying on self-h
Attackers exploit legitimate residential proxies to bypass security filters that trust home ISP addresses. The malice is behavioral, not infrastructural—IP-based edge security can't detect this threat.
Novocure breach exposed 1,400+ cancer patients' medical records and insurance data. Medical information is highly valued on criminal markets for identity theft, fraud, and extortion schemes.
CVE-2026-0768, a critical unauthenticated RCE flaw in Langflow, is being actively exploited to steal API credentials like OpenAI keys and AWS tokens from exposed developer instances.
Aesto Health's 9.5M patient breach exposes the third-party problem: vendors aggregate data across multiple health systems, creating single points of failure patients never consented to.
Iranian hackers pose as recruiters, tricking developers into downloading malware disguised as coding tests. Nimbus Manticore's Node.js/JavaScript RAT exploits trust in the hiring process and works cross-platform on Windows, Linux, and macOS.
Five Venezuelans pleaded guilty to ATM jackpotting—using malware or tampering to steal millions. The prosecution marks a rare US case against crews previously operating mainly overseas.
Nearly 22,000 unpatched Exchange servers remain vulnerable to a known authentication bypass giving attackers full mailbox access without credentials. This reflects persistent patch fatigue and enterprise security failures to apply available updates.
Two critical flaws enable attackers to compromise Langflow instances and probe downstream credentials, revealing a sophisticated long-term persistence strategy rather than immediate data theft.
Microsoft Exchange Online crashed for hours, disrupting email, Teams, and authentication globally. The dual-layer infrastructure failure cascaded broadly, creating helpdesk chaos that persisted beyond recovery.
The perimeter didn't fail—trust did. This week's threats weaponized supply-chain compromise: pre-backdoored routers, proxy exploits, and insider attacks that persist for years, survive resets, and evade detection.
North Korea's fake employee operation has expanded from tech roles into sales, marketing, and healthcare positions, generating hundreds of millions for Pyongyang through weaker vetting standards in non-technical jobs.
An attacker drained $74M from Tectonic via oracle price manipulation, inflating collateral values to borrow excessively. This four-year-old attack pattern continues unabated in DeFi lending protocols.
PaperCut NG/MF zero-day flaws were weaponized for data theft before patches were available, leaving organizations minimal time to defend. This repeats 2023's critical vulnerability that was similarly exploited by ransomware gangs and mass attackers.
ChatGPT's outage revealed how organizations became dependent on AI without formal planning or SLAs. Most use consumer accounts lacking guaranteed uptime, creating sudden vulnerability when the service fails.
File servers harbor years of unchecked permissions that enable ransomware lateral movement. Organizations rarely audit or clean up legacy access, creating an easily exploitable attack surface where one compromised credential cascades across sensitive data.
Fire Ant embedded hidden GRE tunnels in Cisco routers for covert command channels that bypass audit logs and configuration histories, exploiting gaps in IOS XR forensic mechanisms. The technique creates persistent, encrypted exfiltration channels invisible to standard security monitoring.