Cyber Security News

Hacking Editorial Brief – April 24, 2026

AI-driven offensive capabilities continued to demonstrate their operational advantage this week. Project Glasswing's XBOW system became the top-ranked hacker on HackerOne in 2025, outperforming all human researchers, with median disclosure-to-exploit weaponization times dropping significantly. Separately, researchers at Forcepoint documented new indirect prompt injection attacks exploiting AI assistants including GitHub Copilot, where attackers embed hidden instructions in website code to manipulate AI behavior. A critical SSRF vulnerability in LMDeploy (CVE-2026-33626) was actively exploited within 13 hours of public disclosure, with initial attacks traced to Hong Kong infrastructure.

Financial sector incidents dominated breach reporting today. Texas-based fintech Marquis disclosed a ransomware attack exposing 672,075 individuals' personal and financial records, including Social Security numbers. In cryptocurrency markets, a $290 million fraudulent token attack originating at an unnamed startup cascaded into Aave, one of the sector's largest lending protocols, creating systemic instability. Sri Lankan government systems were compromised in what officials describe as the country's largest state-level theft, with attackers redirecting $2.5 million intended for debt repayment to Australia.

Sources: The Hacker News · Hackread · Cyberpress · Fox News · The Information · NDTV