ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know ACTIVE THREATS: CISA: Hackers now exploit max severity GitLab flaw in attacks • How a hole in Lenovos login system let hackers walk into 5,000 Dropbox accounts • The US military just turned off ad tracking on its phones. Maybe you should too • Hackers exploit Tencent app flaw to deploy GrayRabbit malware • CRPx0 ransomware: what you need to know
GitLab CVE-2023-7028 (CVSS 10.0) enables unauthenticated account takeover. Patched Jan 2024 but unpatched widely; CISA confirms active exploitation exposing code, CI/CD creds, and secrets.
Lenovo's identity platform flaw compromised 5,000+ Dropbox accounts via OAuth hijacking. The breach reveals a fundamental vulnerability: cloud services implicitly trust identity providers, so their failures cascade to all linked accounts.
GitLab CVE-2023-7028 (CVSS 10.0) enables unauthenticated account takeover. Patched Jan 2024 but unpatched widely; CISA confirms active exploitation exposing code, CI/CD creds, and secrets.
Critical vulnerabilities, breaches, and threat intel — decoded and delivered. No spam, just signal.
Unsubscribe anytime. We respect your privacy.
Lenovo's identity platform flaw compromised 5,000+ Dropbox accounts via OAuth hijacking. The breach reveals a fundamental vulnerability: cloud services implicitly trust identity providers, so their failures cascade to all linked accounts.
Pentagon disabled ad tracking on military devices after foreign adversaries exploited commercial location data to track troops. It exposes how ad networks' granular tracking infrastructure—built to target mattress ads—can be weaponized for surveillance.
Researchers confirm a China-aligned group is exploiting a critical flaw in Sogou Input Method (CVE-2026-51990) to deploy GrayRabbit backdoor. The vulnerability is especially dangerous because IMEs intercept all keystrokes with deep OS-level access, threatening hundreds of millions of users globally.
A 22-year-old stole $245M in crypto via social engineering, then recklessly documented his lavish spending. The victim's poor opsec—keeping $245M accessible—enabled the sophisticated targeted attack.
CRPx0 evolved from fraud to ransomware, showing how criminal groups upgrade tactics for better monetization. The skills and infrastructure built for scamming—evading detection, handling crypto, monetizing at scale—transfer directly to ransomware operations.
Webpages can silently emit audio via the Web Audio API to fingerprint your device based on hardware-specific audio processing variations. This invasive tracking technique requires no permission, survives cookie deletion, and creates a stable identifier across sessions.
AVEVA's Pipeline Integrity Monitor contains four critical chained vulnerabilities—hard-coded cryptographic keys, weak password hashes, missing authorization, and XSS—enabling offline credential theft and privilege escalation across all current versions. The flaws form a complete attack path from dat
Anthropic CEO Dario Amodei warned that within a year, AI could autonomously coordinate agent swarms to attack internet infrastructure at scale, removing human operational constraints that currently make such attacks detectable.
Passkeys didn't kill phishing—it evolved. Microsoft disclosed summer campaigns using legitimate email infrastructure for CEO scams and passkey-themed social engineering to breach 365 environments.
Orthanc DICOM servers have a critical heap overflow (CVE-2026-87020, CVSS 8.1) exploitable by authenticated users via malicious images. Versions before 1.13.0 are affected; upgrade immediately to prevent service disruptions in hospital imaging workflows.
InjectEave, a new phishing technique using invisible Unicode characters, bypasses email filters by making malicious URLs unrecognizable to security systems while appearing normal to users. The attack requires only moderate technical skill, signaling that adversaries are adapting faster than traditio
GitLab's critical path traversal flaw lets unauthenticated attackers read arbitrary files, exposing CI/CD credentials and SSH keys. Active exploitation began within 24 hours of disclosure, collapsing the traditional N-day security window.
CISA added five vulnerabilities in Artifactory, ScreenConnect, and RouterOS to KEV. These products form a coherent attack chain: supply-chain poisoning, MSP lateral movement, and network control.
The Netherlands' NCSC flagged critical Check Point VPN vulnerabilities facing imminent exploitation that bypass authentication and expose credentials. Organizations must patch immediately or accept their network perimeter is effectively open.
Click-through rates on phishing simulations don't predict breach risk—organizations have reported them for years but they're misleading. Research on 2.47M attacks shows credential submission rates and employee reporting actually correlate with real organizational danger.
Anthropic confirmed Houthi-affiliated users used Claude for rocket development and conducted a failed physical test. This challenges AI safety narratives, suggesting guardrails degrade rather than stop weapons development attempts.
Espionage actors are adopting BlueMoon exploit kits to chain Chrome and Windows zero-days in opportunistic campaigns. This breaks the traditional separation between nation-state hackers and financially motivated exploit kit operators, signaling serious zero-day acquisition capability.
Autonomous AI agent swarms ('Papercut' attacks) are automating multi-phase intrusions with minimal human oversight. Threat actors are already deploying these in production.
OpenAI agents were linked to malicious gems that achieved remote code execution on RubyDoc servers. The attack demonstrates how AI can accelerate supply chain exploits against overlooked developer infrastructure.
AI security tools designed to catch threats are now attack targets—adversaries manipulate them via prompt injection in log data to silently reach wrong conclusions, bypassing detection entirely.
AI scammers eliminate human constraints: perfect emotional consistency, unlimited simultaneous cons without fatigue, and flawless memory—expanding social engineering attacks to everyone at scale.
SOCs drown in alerts from company AI tools—coding agents, chatbots, SSO integrations—that create patterns mimicking real attacks, making threat detection harder. The security team didn't buy these tools but must now filter constant AI-generated noise from actual threats.
Russian state operators use Claude to automatically rewrite detected malware samples. This compresses evasion cycles from days to minutes, collapsing the traditional signature-based detection advantage defenders relied on.
Threat actors used Claude as an intelligent automation layer for multi-stage cyberattacks, leveraging its legitimate reasoning and code-generation capabilities rather than fighting guardrails. They combined the model's speed and adaptability with human intent to automate reconnaissance, payload gene