ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
SAP patched four critical vulnerabilities in its NetWeaver ERP platform affecting financial services, manufacturing, and healthcare enterprises. Flaws enable identity spoofing via XML signature manipulation and unauthenticated remote code execution through memory corruption, requiring immediate ente
The Hades campaign compromised 19 PyPI packages with malicious code executing at startup to steal developer credentials from AWS, GCP, Azure, GitHub, Kubernetes, and CI/CD platforms.
FROST exploits SSD timing variations through JavaScript to track which websites and apps you visit, achieving 89-96% accuracy on macOS and Linux with no permissions or traces. This passive browser-based side-channel attack could remotely target millions of users simultaneously.
The real security bottleneck is no longer detection—it's the operational coordination between tools. Security teams waste hours manually context-switching alerts across disconnected systems (SIEM, firewall, identity, cloud, ticketing), introducing delays and human error that become the actual vulner
CISA ordered federal agencies to patch a critical Check Point VPN vulnerability within 72 hours. The CVSS 9.8 flaw enables authentication bypass, and Qilin ransomware actively exploits it for network access.
Google released an emergency patch for CVE-2026-XXXXX, a critical Chrome zero-day actively exploited in targeted attacks against government officials and security researchers. The use-after-free vulnerability in Chrome's rendering engine enables remote code execution across Windows, macOS, and Linux
CVE-2026-42271 is a critical command injection flaw in LiteLLM now actively exploited. Authenticated attackers can execute arbitrary code via unsanitized input. The 10M-download library is widely used in AI/ML pipelines.
Google released Chrome 149 to patch CVE-2026-11645, a critical V8 vulnerability actively exploited in the wild. This marks the fifth zero-day discovered in 2026, reflecting an accelerating threat landscape as attackers chain memory vulnerabilities with sandbox escapes for full system compromise.
Silent Ransom Group has compromised a dozen US law firms through phishing, stealing confidential files and demanding $100k-$2.5M ransoms. The group remains undetected for 60-90 days.
SoFi's Hong Kong subsidiary suffered a data breach via a third-party vendor (discovered April 30, disclosed June 8, 2026). Limited details released on scope or affected customer records.
NFCShare Android malware resurges targeting European banks, distributed via GitHub. It tricks victims with fake verification screens into scanning payment cards via NFC, stealing card data and PINs.
Check Point VPN critical flaw (CVE-2026-50751) bypasses authentication and is actively exploited by ransomware attackers to breach corporate networks. IKEv1 users must patch immediately.
CVE-2026-23111, a one-character Linux kernel bug in nf_tables, enables unprivileged root escalation. Public exploits are now available; despite February patches, many systems remain vulnerable.
The Shai-Hulud attack compromised 19 PyPI packages, stealing developer secrets via .pth files and obfuscated JavaScript payloads. Hundreds of thousands of downloads affected, part of a broader 453-artifact campaign targeting the open-source ecosystem.
Apple's new Apple Intelligence feature automatically changes weak and compromised passwords without user intervention—addressing password fatigue but raising questions about autonomous AI making security decisions. The system tackles a persistent threat, though it demands careful permission models a
AI-generated code outpaces traditional security review, leaving organizations flying blind. As developers embrace rapid "vibe coding" workflows, security gatekeeping mechanisms designed for slower development cycles fail to catch risks—including outdated cryptographic standards and unapproved depend
Iran's ceasefire exempts cyber operations, allowing hackers to continue attacks during the pause. This exposes a critical gap: international law lacks rules for digital warfare, letting one side attack digitally while observing a conventional ceasefire.
WhatsApp has disrupted NSO Group-attributed spear-phishing campaigns targeting user accounts through social engineering. The attacks aimed to compromise credentials and enable malware installation, highlighting persistent threats from state-level surveillance actors.
A Security raised $37M Series A funding to automate vulnerability discovery and remediation using autonomous agents. The startup simulates AI-driven attacks to identify and fix vulnerabilities before attackers can exploit them, addressing the growing complexity of enterprise threat defense.
"Hades" campaign compromises 37 PyPI wheels using Shai-Hulud malware to steal developer credentials and establish persistent supply chain footholds, marking an escalation from one-time injections to self-sustaining threats in the open-source ecosystem.
Meta filed a contempt order after NSO Group launched phishing attacks on WhatsApp, using malicious domains to trick users into compromising their credentials. The campaign violates an existing federal injunction and marks the fourth documented breach by the Israeli spyware vendor.
UniFi OS Server vulnerability chain (CVE-2026-34908/09/10) enables unauthenticated root access. Patched May 2026, but Ubiquiti initially failed to disclose the flaws could be chained together.
Gogs patched a critical RCE vulnerability after Rapid7 disclosure. An argument injection flaw exploits default settings enabling unauthenticated users to escalate privileges and compromise instances.
Microsoft's 73 GitHub repositories were breached by Miasma, a self-replicating worm exploiting developer credentials to corrupt code and spread across the supply chain, forcing GitHub to disable access. The attack demonstrates how effective self-replicating malware remains against critical software