ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
The full HackWire archive — 3,892 stories, newest first.
Chinese military intelligence is running fake job recruitment campaigns targeting Five Eyes personnel (US, UK, Australia, Canada, New Zealand) to extract classified intelligence. They use false recruiter identities on professional networks to identify and screen security-cleared government employees
Everest Forms Pro (CVE-2026-3300) has a critical RCE flaw enabling unauthenticated code execution via forms. Actively exploited since April 2026, it has compromised thousands of WordPress sites.
RCI disclosed a data breach exposing 40,000 individuals after March unauthorized network access. Attackers exfiltrated personal and financial data in another entertainment sector cyberattack.
**FBI warns of FIFA World Cup 2026 fraud campaigns using fake ticketing sites, banking trojans embedded in pirate streams, and phishing attacks. Thousands of malicious domains are already active targeting fans ahead of June 11's kickoff.**
Cisco disclosed CVE-2026-20245, a critical SD-WAN vulnerability allowing authenticated attackers root command execution. The 7th zero-day in 2026, it remains unpatched with active exploitation.
PCPJack hijacked 230 cloud servers across AWS, Google Cloud, and Azure to create an SMTP relay network for phishing campaigns, using automated systems to maintain a constantly refreshed proxy list.
Unpatched zero-day CVE-2026-20245 in Cisco Catalyst SD-WAN Manager enables root escalation and is actively exploited. Attackers chain it with other Cisco flaws to compromise networks.
TA4922, a Chinese cybercrime group, expanded from Japan-focused phishing to global campaigns across Asia, Europe, and Africa. It's now one of the most versatile threat actors tracked.
IronWorm malware harvests developer credentials to hijack npm packages and spread malicious updates. Compromising 36+ packages with 32,000+ monthly downloads, it demonstrates the escalating threat to open source supply chains.
Hola Browser for Windows was compromised via supply chain attack, installing an undeclared Monero cryptominer. The unsigned malware, discovered by Sophos during certification testing, featured obfuscation and persistence mechanisms.
Brave launched Brave Origin, a $59.99 paid browser removing monetization features like crypto rewards and AI while keeping privacy tools. The pivot reflects rising user demand for simplicity over feature bloat.
Meta's AI chatbot flaw let attackers hijack Instagram accounts by simply requesting password resets. No technical skill needed; major brands and government accounts were compromised.
Hitachi Energy RTU500 devices controlling power grids and water systems globally contain seven critical vulnerabilities enabling denial-of-service attacks. Firmware versions 12.7.1–13.8.1 require immediate patching to prevent cascading infrastructure failures.
B&R PPT30's OPC-UA Server (CVE-2025-11482, CVSS 7.5) is vulnerable to unauthenticated network DoS attacks that exhaust resources and disable the interface, disrupting manufacturing and critical infrastructure automation operations.
Enterprises lag on four emerging threats where attackers hold the advantage: deepfakes, supply chain compromises, prompt injections, and AI hijacking. Attackers exploit these new surfaces faster than defenses mature, with 62% of organizations already hit by deepfake attacks.
Magecart weaponizes Stripe and Google Tag Manager to steal credit cards undetected. By routing theft through trusted domains, the malware bypasses security filters and blends into normal checkout traffic at scale.
Two critical libexpat vulnerabilities in Hitachi Energy's ITT600 testing tool enable unauthenticated remote DoS attacks via crafted IEC 61850 messages. CVE-2024-8176 (stack overflow) and CVE-2025-59375 (memory exhaustion) both score CVSS 7.5 and impact ICS utilities globally.
Hitachi's MACH HiDraw XML parser has a buffer overflow (CVE-2026-7310) affecting power grids and critical infrastructure. Local authenticated users can execute arbitrary code or cause denial of service.
NAVTOR NavBox contains hard-coded SOAP credentials, allowing local attackers to bypass authentication and gain privileged access. This could manipulate maritime navigation systems globally.
Bugcrowd launched an EU data residency option, allowing organizations to store security research data within European borders. This reflects rising demand for data sovereignty driven by geopolitical tensions and strict regulations like GDPR.
DentaQuest, one of the nation's largest dental benefits administrators, suffered a breach exposing 2.6 million patients' personal, health, and financial data. The incident poses significant risks for identity theft and medical fraud among affected individuals.
Willow, an Israeli startup, raised $7M to control autonomous AI agents in enterprises, addressing a critical security gap: preventing AI systems from unchecked data access, system modification, and privilege escalation without proper guardrails.
TA4922, a China-linked cybercrime group, has expanded globally with phishing and messaging app evasion tactics to steal credentials and data from organizations across Europe and Africa.
Unauthorized access claims against Anthropic's Claude Mythos preview highlight critical security gaps in deploying agentic AI in defense networks. Autonomous agents create complex attack surfaces that legacy government security controls can't adequately protect.