Attackers got into the Northflank hosting platform and used customers' AI service keys without permission. Those keys can be used to run up bills or access AI services as if they were the customer.

1. How it works:
2. Attacker breaches Northflank
3. Platform secrets exposed
4. AI API keys obtained
5. Keys used by attacker
6. Attacker uses customers' AI API keys

A blockchain analysis firm had an intruder get into some internal tools. The intruder could see basic customer contact details, such as names and email addresses.

1. How it works:
2. External actor
3. Internal tools accessed
4. Customer identity data
5. Customers at risk
6. Customer contact details exposed to attacker

Attackers who already have a login to Ivanti Connect Secure, a remote-access VPN gateway, can upload files of their choosing to a predictable place on the server. Attackers are actively using this flaw.

1. How it works:
2. Attacker logs in
3. Uploads crafted file
4. Chains with other flaws
5. Gateway compromised
6. Attacker gains control of VPN gateway

A person who already has a login on the Ivanti VPN server can use a flaw to take over the whole server. Attackers are already using it.

1. How it works:
2. Local account holder
3. Broker trusts DSCache
4. Privilege escalation
5. Attacker gains control
6. Attacker controls the Ivanti appliance as root

A fake copy of a popular AI coding helper was available for about 11 hours and could quietly give attackers secret remote access to developers' computers. Anyone who installed it may need to clean up their machine and check their SSH keys.

1. How it works:
2. Attacker publishes fake
3. Cursor marketplace listing
4. Developer installs it
5. Backdoor installed
6. Attacker has persistent SSH access to developers' machines

A bug in WordPress itself could let an outsider take control of a website without logging in. Attackers have started trying to use it within hours of the fix being released.

1. How it works:
2. Attacker scans sites
3. Sends crafted requests
4. Server runs attacker code
5. Data and site at risk
6. Attacker gains control of the site

Attackers can reach store pages and data they should not be able to see or change, such as orders. Attacks are already happening against online shops.

1. How it works:
2. Attacker
3. Direct request
4. Missing check
5. Store data
6. Attacker reads or alters store data

Hackers stole a huge amount of cryptocurrency from Binance, one of the world's largest crypto exchanges, after breaking into an employee's work laptop. Some of the stolen funds have been frozen, but most of the damage is still being assesse

1. How it works:
2. Attacker targets engineer
3. Laptop compromised
4. Internal access gained
5. Assets moved out
6. About $6.3 billion in assets stolen

Scam emails pretending to come from Anthropic, the AI company, are getting into inboxes even though they have obvious warning signs. Those emails can trick people into clicking links or handing over information.

Attackers slipped malicious code into the Polymarket website through a outside service. While signed-in users used the site, their funds were moved to attacker wallets.

1. How it works:
2. Attacker compromises vendor
3. Malicious script swapped in
4. Signed-in user loads site
5. Funds moved out
6. Attacker drains trader funds

A bug in how Linux handles network connections can let an outsider with no password take full control of a server. Attackers can reach it over the internet if the server accepts connections.

1. How it works:
2. Remote attacker
3. Crafted SYN packets
4. Freed memory reused
5. Code runs in kernel
6. Attacker runs commands as root

Hackers got into a contractor's computer systems that send notices for federal bankruptcy courts, and those notices were delayed for weeks. The contractor says no data was taken.

Attackers are abusing recently patched PHP bugs to take control of servers and firewalls that are reachable from the internet. Some of these attacks have reached government-affiliated systems.

1. How it works:
2. Attacker scans
3. Exploits PHP2Shell
4. Gains shell access
5. Chains Fragnesia
6. Attacker controls the server as root

Someone with no login could send a specially crafted pattern in a GitLab pipeline setting and run their own commands on the GitLab server. Attackers are already trying this, so unpatched servers need updating now.

1. How it works:
2. Attacker crafts pattern
3. Request reaches GitLab
4. Regex not validated
5. Code runs on server
6. Attacker runs code on GitLab server

Attackers used a trick to get into software projects hosted on GitHub, and some of them are still inside. If your team builds or ships code there, someone unwanted may still have access.

1. How it works:
2. Campaign launched
3. Projects compromised
4. Developer endpoints
5. Cloud access
6. Attackers keep access inside developer environments

Attackers can sneak into the systems that manage a company's SD-WAN network without a password and gain admin rights. From there they can change how the network is set up and steal the keys that encrypt traffic.

1. How it works:
2. Unauthenticated attacker
3. Peering auth bypassed
4. Admin account obtained
5. NETCONF access
6. Attacker controls SD-WAN network and steals keys

Records on tens of thousands of Homeland Security employees and contractors were posted publicly online, including contact details and information about sensitive assignments. Anyone who had their details exposed could be targeted by scams

1. How it works:
2. Attacker gets access
3. Okta SSO system
4. Staff records stolen
5. Published online
6. 41,000 staff records exposed publicly

A travel-industry software provider used by Japan Airlines was hacked, and some customers' personal details may have been stolen. Passport numbers and contact details are among the data reported as taken.

1. How it works:
2. Attacker breaches system
3. Amadeus PSS compromised
4. Passenger data stolen
5. Customers at risk
6. Passenger personal data exposed to criminals

A person who already has administrator access to VMware ESX servers can do things that leave no record in the logs. That makes it harder to notice or investigate an intrusion.

1. How it works:
2. Admin access gained
3. Hidden operations
4. Audit trail gaps
5. Intrusion goes undetected in logs

A bug in the Linux operating system's core can let an attacker quietly change data that the system treats as trusted, and chained with other flaws it can give them full control of the server. Attackers are already using it.

1. How it works:
2. Attacker sends traffic
3. Kernel coalesces buffers
4. ESP decrypts in place
5. Webshell implanted
6. Attacker runs commands as root

Attackers can send a specially crafted request to a Cisco firewall's VPN login page and make it restart, cutting off network access. Attacks are already happening in the wild.

1. How it works:
2. Attacker sends request
3. Request reaches firewall
4. Logic error triggers
5. Firewall reloads
6. Firewall goes down, network access lost

A state-sponsored hacking group is routing its attacks through chains of hijacked routers, cameras and other small devices, which makes the attacks hard to trace. The group has used this method to exploit previously unknown security flaws.

1. How it works:
2. Volt Typhoon operator
3. Rotating device chain
4. Zero-day exploit
5. Strategic access
6. Attacker gains hidden access to high-value systems

A car rental company in Japan had personal information leaked, including driver's license details for about 1.46 million people. Those people could face fraud or identity theft.

Attackers are disguising their scanning programs as legitimate AI company bots. If your systems leak passwords or access keys, these bots can find them and let attackers in.

1. How it works:
2. Threat actor
3. Impersonated AI bots
4. Exposed systems
5. Credentials found
6. Attacker gains usable credentials

Attackers send fake messages that get people to approve a login code on a real Microsoft-style sign-in page, handing over access to work accounts without the attacker ever needing the password. Most of the targets are US organizations.

1. How it works:
2. Phishing message sent
3. User starts device login
4. User enters attacker's code
5. Tokens issued to attacker
6. Attacker gains access to corporate accounts

Attackers can trick Oracle PeopleSoft into reaching its own hidden admin area, which can let them take control of the system. A criminal group called ShinyHunters has been using it since May.

1. How it works:
2. Attacker sends request
3. SSRF triggered
4. Loopback trusted
5. Internal interface reached
6. Attacker reaches internal management functions

Hackers broke into a Japanese cloud service that gives customers remote Windows computers. They threatened to lock up data with ransomware, so customers were told to unplug their PCs from the internet and shut them down.

1. How it works:
2. Attacker breaches service
3. Extortion demand
4. Ransomware threatened
5. Customers disconnect
6. Customer systems at risk of ransomware

Attackers reportedly altered a shared tracking script used by Convertr so it could copy shoppers' credit card details while they pay. Anyone entering card information on affected stores may be at risk.

1. How it works:
2. Skimming group
3. Analytics script
4. Shopper browser
5. Card data copied
6. Shoppers' card data is stolen

Hackers targeted the US Federal Election Commission's website, and its electronic filing system was shut down. People who need to file campaign reports electronically may be unable to do so until it is back.

A weakness lets someone upload a file of a dangerous type to the shop software, which can let them run their own code on the site and take over a logged-in user's account. The attacker typically needs a victim to visit a malicious link or a

1. How it works:
2. Attacker crafts link
3. Victim visits page
4. Malicious file processed
5. Code runs in user context
6. Attacker controls victim's account and session

Hackers may have broken into Moldova's government online services and taken people's personal information. Officials warn more attacks like this could follow.

Hackers, possibly including foreign government groups, attacked the Ohio state auditor's public website, so the state temporarily shut that server down. The state says Ohioans' personal financial information is not believed to be at risk.

Attackers used AI software to automate parts of breaking into organizations in Japan. The AI helped run the attacks faster, with less manual work by the attacker.

1. How it works:
2. Operator sets goal
3. AI agents coordinate
4. Scan exposed targets
5. Access organization servers
6. Attackers gain automated access to victim systems

A cyberattack locked up computer systems at a major hospital network, so ambulances were diverted and many appointments were cancelled. A criminal group has claimed responsibility.

1. How it works:
2. Ransomware group
3. Systems breached
4. Services disrupted
5. Care impacted
6. Health system operations halted

An outside attacker got into Capcom's account system and reached personal data for millions of player accounts. Some accounts reportedly had their passwords changed, so you could be locked out.

1. How it works:
2. Attacker
3. Capcom ID
4. Account data
5. Passwords
6. Accounts exposed and some locked out

Scammers got hold of personal details of military members from a Pentagon data system. Those details can be used to impersonate people or open accounts in their names.

A criminal group called SafePay locks up company computers and files, then demands payment to unlock them. Law enforcement says they have hit at least 600 organizations since August 2024.

Companies that provide IT services to UK police forces were hacked several times, and police data held by those companies may have been exposed. Attackers got in through the suppliers rather than directly through police systems.

1. How it works:
2. Hackers
3. Supplier systems
4. Police data
5. Police data exposed via suppliers

Attackers got a secret key that proves Keystone crypto wallets are genuine. With that key they could make fake wallets that look real, so buyers could lose their crypto.

1. How it works:
2. Attacker breaches website
3. Verification key stolen
4. Counterfeit devices built
5. Buyer trusts fake
6. Counterfeit wallets could steal buyers' crypto

Hackers got into a test system at the University of Copenhagen that held personal information. About 525,000 people may have had their details exposed, and some PIN codes were exposed too.

1. How it works:
2. Hackers gain access
3. Test environment reached
4. Personal data accessed
5. PIN codes exposed
6. Personal data and PINs exposed

Attackers hide instructions inside ordinary text files that AI coding helpers read. The helper may follow those hidden instructions as if you had asked for them, possibly taking actions you did not intend.

1. How it works:
2. Attacker plants file
3. Project includes file
4. AI agent reads it
5. Agent acts on text
6. Assistant performs attacker-chosen actions

A cybercrime group used a hacking tool called ARTEX AI to break into more than 90 organizations in South Korea and steal millions of personal records. Anyone whose data was held by those organizations may be at risk of scams or identity mis

1. How it works:
2. Former pentester
3. ARTEX AI framework
4. 90+ organizations
5. 8.2M records
6. Millions of records stolen

Hackers have hidden malicious code in about 953 online shops, mostly ones built on Magento. Shoppers visiting these stores may have that code run in their browser without knowing it.

1. How it works:
2. Threat actor
3. Store compromised
4. Visitor loads page
5. Malicious loader runs
6. Shopper's browser runs attacker code

Attackers are using stolen GitHub access tokens to take passwords and cloud keys from software developers' code projects. Anyone whose project or access tokens are caught in this could have their cloud accounts and private data exposed.

1. How it works:
2. Attacker abuses tokens
3. Repositories accessed
4. Secrets harvested
5. Cloud access gained
6. Attacker reaches cloud secrets and data

Criminals pose as IT support in Microsoft Teams chats and talk people into installing malicious software. That software can lock files for ransom or steal data.

1. How it works:
2. Fake IT account
3. External Teams chat
4. Employee trusts it
5. Malware installed
6. Attacker gains access to the organization

Hackers are getting into internet-connected Dahua security cameras and video recorders. Once inside, they can watch live video, change settings, and create their own login accounts.

1. How it works:
2. Attacker scans
3. Weak access
4. Device taken over
5. Accounts added
6. Attacker keeps control of the cameras

A feature that shortens long chats with OpenAI's AI models could be misused to read the model's private reasoning, which is normally hidden from users. Competitors could use that to copy the model more cheaply.

1. How it works:
2. Attacker uses compaction
3. Reasoning exposed
4. Traces copied
5. Rival model distilled
6. Hidden AI reasoning is copied

Attackers tricked people into signing in through a fake relay that copied their login session. They then reused that copied session to get into email accounts without needing the password again.

1. How it works:
2. Phishing lure
3. AitM relay
4. User signs in
5. Token stolen
6. Attacker reads email at compromised accounts

Attackers who steal GitHub login tokens are adding hidden automated jobs to code projects that print the project's passwords and keys into the build logs. The attackers then download those logs and delete them, so the secrets leave without

1. How it works:
2. Stolen token
3. Plant workflow
4. Secrets in logs
5. Download logs
6. Repository secrets are stolen

Attackers are actively using a serious weakness in F5 BIG-IP APM, a device that controls who can log in to a company's internal systems. If left unpatched, an outsider could potentially get into systems they should not reach.

A state-linked hacking group broke into ConnectWise's cloud backup software and used an AI-driven tool to speed up attacks on many customer accounts. Organizations that use this backup product may have been targeted.

1. How it works:
2. Storm-0940 actor
3. ConnectWise backup app
4. ARTEX AI tool
5. 2,200+ tenants
6. Many customer tenants exposed to attackers

A popular AI developer tool was compromised by attackers who secretly ran programs that collected passwords and access keys from its build system. Anyone who installed a bad version of the package could have had their own credentials stolen

1. How it works:
2. Master key leaked
3. Malicious workflows
4. Release pipeline hijacked
5. Users install bad version
6. Attacker harvests credentials from many users

Criminal groups reportedly used AI tools to run break-ins with less human effort, making attacks faster and easier to scale. Their goal is to steal data and demand payment.