This week in Wordfence Security News (Week of September 14, 2026):

• The Events Calendar patched two critical RCE chains on September 10; Wordfence logged the first exploit attempt 2.2 hours after disclosure.
• Wordfence's firewall matched 3,285 requests across 619 sites in four and a half days, 2,103 consistent with exploitation.
• N-able fixed a maximum severity pre-auth RCE in N-central; CISA's federal remediation deadline of September 11 has passed.
• StyleSmuggler hit Adobe Commerce and Magento Open Source on September 4, three days before Adobe's CVSS 10.0 hotfix.
• GitLab patched a critical unauthenticated path traversal on September 10; attackers probed it within 24 hours of disclosure.
• Chrome's September 8 update shipped 230 security fixes, including a medium-rated V8 out-of-bounds write exploited in the wild.

Timestamps:

0:00 Introduction

0:35 The Events Calendar unauthenticated object injection to RCE

2:42 N-able N-central pre-authentication RCE

3:49 StyleSmuggler Adobe Commerce and Magento zero-day

4:57 GitLab repository Commits API path traversal

5:38 Chrome/Chromium V8 out-of-bounds write

Story Links:

• The Events Calendar unauthenticated object injection to RCE
• Wordfence Argus identifies two critical unauthenticated RCE chains in The Events Calendar (Wordfence blog)
• N-able N-central pre-authentication RCE
• StyleSmuggler Adobe Commerce and Magento zero-day
• GitLab repository Commits API path traversal
• Chrome/Chromium V8 out-of-bounds write

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• (00:00) - Introduction
• (00:35) - The Events Calendar unauthenticated object injection to RCE
• (02:42) - N-able N-central pre-authentication RCE
• (03:49) - StyleSmuggler Adobe Commerce and Magento zero-day
• (04:57) - GitLab repository Commits API path traversal
• (05:38) - Chrome/Chromium V8 out-of-bounds write

This week in Wordfence Security News (Week of July 20, 2026):

• WP2Shell chains two WordPress core bugs into unauthenticated RCE on default installs of 6.9 and 7.0; CISA added both flaws to its KEV catalog on July 21.
• Attackers had root on SonicWall SMA 1000 VPN appliances for about three weeks before the July 14 advisory, capturing LDAP credentials off the wire.
• A separate Palo Alto GlobalProtect authentication bypass was the way in for June intrusions that ended in Qilin ransomware.
• A pre-auth ServiceNow AI Platform sandbox escape was exploited three days after its write-up went public; self-hosted and partner-managed instances are at risk.
• CISA added a 2008 Cisco IOS flaw to its KEV catalog as allied agencies warned of an FSB unit copying router configurations over weak SNMP.
• OpenAI says its own models escaped an evaluation sandbox and hacked Hugging Face to grab benchmark answers.
• The Jscrambler and AsyncAPI npm compromises stole developer secrets in ways that disabling install scripts would not stop.

Timestamps:

0:00 Introduction

0:48 WP2Shell WordPress core unauthenticated RCE

5:38 SonicWall SMA 1000 VPN zero-days

7:50 ServiceNow AI Platform pre-auth RCE

9:22 2008 Cisco IOS flaw added to CISA KEV

11:30 OpenAI models hack Hugging Face

14:16 AsyncAPI and Jscrambler npm compromises

Story Links:

• PSA: WordPress Core patched unauthenticated RCE vulnerability chain (Wordfence)
• wp2shell aftermath: the first critical unauthenticated WordPress core RCE in nearly a decade (Wordfence)
• WP2Shell exploit technical analysis and real attack data (Wordfence)
• WP2Shell: pre-authentication RCE in WordPress core
• SonicWall SMA 1000 VPN zero-day exploitation
• Palo Alto GlobalProtect bypass leads to Qilin ransomware
• ServiceNow AI Platform pre-auth RCE (CVE-2026-6875)
• CISA adds 2008 Cisco IOS flaw to KEV
• Joint advisory on FSB targeting of network devices
• OpenAI on the Hugging Face model evaluation incident
• AsyncAPI npm supply chain compromise (Microsoft)
• Jscrambler supply chain attack (Socket)

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• (00:00) - Introduction
• (00:48) - WP2Shell WordPress core unauthenticated RCE
• (05:38) - SonicWall SMA 1000 VPN zero-days
• (07:50) - ServiceNow AI Platform pre-auth RCE
• (09:22) - 2008 Cisco IOS flaw added to CISA KEV
• (11:30) - OpenAI models hack Hugging Face
• (14:16) - AsyncAPI and Jscrambler npm compromises

This week in Wordfence Security News (Week of July 13, 2026):

• Exposed hacker server reveals mass WordPress backdooring op chaining 27 known flaws; over 25,000 sites with confirmed or validated compromise
• Critical Adobe ColdFusion path traversal patched June 30 saw exploitation attempts within hours of technical details going public
• SharePoint Server on-prem RCE Microsoft rated exploitation less likely added to CISA's exploited catalog July 1
• New NetScaler pre-auth memory overread leaks process memory on SAML IdP configs, echoing CitrixBleed
• RoguePlanet, a fourth Defender flaw from the BlueHammer researcher, escalates a local attacker to system
• Sysdig assesses the first documented agentic ransomware case: an AI agent encrypted 1,342 config items via a Langflow flaw
• Symlink trick in a booby-trapped GitHub repo fools six AI coding assistants into writing an attacker SSH key

Timestamps:

0:00 Introduction

0:52 WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring Operation

4:39 Adobe ColdFusion Flaw Exploited After Details Go Public

6:08 SharePoint Flaw Microsoft Called Unlikely Is Now on CISA's List

7:21 New NetScaler Flaw Echoes CitrixBleed

8:19 Microsoft Patches RoguePlanet, Fourth Defender Flaw from Same Researcher

9:14 Researchers Describe Possible First AI-Run Ransomware Attack

11:27 Symlink Trick Fools Six AI Coding Assistants

Story Links:

• WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring Operation
• Adobe ColdFusion Flaw Exploited After Details Go Public
• SharePoint Flaw Microsoft Called Unlikely Is Now on CISA's List
• New NetScaler Flaw Echoes CitrixBleed
• Microsoft Patches RoguePlanet, Fourth Defender Flaw from Same Researcher
• Researchers Describe Possible First AI-Run Ransomware Attack
• Symlink Trick Fools Six AI Coding Assistants

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• (00:00) - Introduction
• (00:52) - WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring Operation
• (04:39) - Adobe ColdFusion Flaw Exploited After Details Go Public
• (06:08) - SharePoint Flaw Microsoft Called Unlikely Is Now on CISA's List
• (07:21) - New NetScaler Flaw Echoes CitrixBleed
• (08:19) - Microsoft Patches RoguePlanet, Fourth Defender Flaw from Same Researcher
• (09:14) - Researchers Describe Possible First AI-Run Ransomware Attack
• (11:27) - Symlink Trick Fools Six AI Coding Assistants

This week in Wordfence Security News:

• OMGF Pro unauthenticated file upload exploited during disclosure: 60,000+ blocked attempts across nearly 8,000 sites, fixed in 5.2.7
• Oracle E-Business Suite Payments auth bypass exploited in the wild despite a May patch; Shadowserver tracked around 950 exposed EBS instances
• PTC Windchill and FlexPLM unauthenticated RCE added to CISA KEV on June 25 after attackers deployed JSP web shells
• BlueHammer, the deliberately leaked Microsoft Defender flaw, now flagged by CISA as used in ransomware attacks
• SimpleHelp OIDC signature flaw grants fake technician accounts, dropping the Taskweaver loader and Djinn info stealer
• Mozilla 0DIN demo shows a clean GitHub repo tricking Claude Code into fetching a DNS TXT payload and opening a shell

Timestamps:

0:00 Introduction

0:48 Active Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload

3:42 Oracle E-Business Suite Payments Exploited in the Wild

5:21 PTC Windchill / FlexPLM RCE Added to CISA KEV

6:21 BlueHammer Microsoft Defender Flaw Used in Ransomware Attacks

6:57 SimpleHelp Auth Bypass Exploited to Deploy Djinn Stealer

8:46 Clean GitHub Repo Tricks AI Coding Agents Into Running Malware

Story Links:

• Active Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload During Responsible Disclosure Window.
• Oracle E-Business Suite Payments Exploited in the Wild
• PTC Windchill / FlexPLM RCE Added to CISA KEV
• BlueHammer Microsoft Defender Vulnerability Exploited in Ransomware Attacks
• SimpleHelp Auth Bypass Exploited to Deploy Djinn Stealer
• Clean GitHub Repo Tricks AI Coding Agents Into Running Malware / Mozilla 0DIN Claude Code Demo

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

This week in Wordfence Security News (Week of June 23, 2026):

• Uncanny Automator Pro Backdoored Through Update Server
• Splunk Enterprise Flaw Exploited in the Wild
• Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls
• LiteLLM Flaw Puts AI Gateway Keys at Risk
• Malicious JetBrains Plugins Stole AI API Keys

Timestamps:

00:00 Intro
00:37 Uncanny Automator Pro Backdoored Through Update Server
06:08 Splunk Enterprise Flaw Exploited in the Wild
08:54 Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls
11:49 LiteLLM Flaw Puts AI Gateway Keys at Risk
14:39 Malicious JetBrains Plugins Stole AI API Keys

Story Links:

1. Uncanny Automator Pro Backdoored Through Update Server

2. Splunk Enterprise Flaw Exploited in the Wild

3. Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls

4. LiteLLM Flaw Puts AI Gateway Keys at Risk

5. Malicious JetBrains Plugins Stole AI API Keys

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

This week in Wordfence Security News (Week of June 15, 2026):

• ShapedPlugin's paid pro plugins were backdoored via the vendor's update system, stealing passwords and 2FA secrets
• OptinMonster, TrustPulse, and PushEngage served a tampered CDN script that targeted logged-in admins
• Oracle PeopleSoft zero-day exploited by ShinyHunters hit 300+ systems, 68% in higher education
• Ivanti Sentry CVSS 10 OS command injection flaw gives attackers root, added to CISA KEV
• Langflow AI app builder path traversal flaw now actively exploited against unpatched instances
• phpBB authentication bypass lets attackers hijack any account with just a username and one request

Timestamps:

0:00 Introduction

0:42 ShapedPlugin Multiple Plugins Supply Chain Compromised

5:11 OptinMonster / TrustPulse / PushEngage Tampered Script Served via Compromised CDN

7:48 Oracle PeopleSoft Zero-Day Exploited by ShinyHunters

10:17 Ivanti Sentry CVSS 10 RCE Added to KEV

11:53 Langflow RCE Actively Exploited Against Exposed AI App Builders

13:46 phpBB Authentication Bypass Lets Attackers Hijack Accounts

Story Links:

• ShapedPlugin Multiple Plugins Supply Chain Compromised
• OptinMonster / TrustPulse / PushEngage Tampered Script Served via Compromised CDN
• Oracle PeopleSoft Zero-Day Exploited by ShinyHunters
• Ivanti Sentry CVSS 10 RCE Added to KEV
• Langflow RCE Actively Exploited Against Exposed AI App Builders
• phpBB Authentication Bypass Lets Attackers Hijack Accounts

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

In this episode of Wordfence Security News:

• Kirki's password reset endpoint lets unauthenticated attackers redirect admin reset links to any inbox, enabling full account takeover.
• UpdraftPlus UpdraftCentral auth bypass allows unauthenticated attackers to install plugins and achieve remote code execution on connected sites.
• Check Point Remote Access VPN zero-day exploited since May 7 lets attackers bypass credentials entirely; one intrusion tied to Qilin ransomware affiliate.
• Cisco Catalyst SD-WAN Manager zero-day command injection, chainable with two auth bypasses, lets attackers push rogue config to all edge devices as root.
• Chrome 149 patches 429 vulnerabilities - nearly triple the previous record - including 22 critical CVEs, with $208,000 in bounty rewards paid out.
• Miasma supply chain worm hit 113+ GitHub repositories by planting AI coding tool config files that exfiltrate cloud credentials on folder open.

Timestamps:

0:00 Introduction

0:39 Kirki Password Reset Exploit Goes Live

2:59 UpdraftPlus UpdraftCentral Auth Bypass to RCE

6:50 Check Point VPN Zero-Day Exploited by Qilin Ransomware Affiliate

8:59 Cisco SD-WAN Manager Zero-Day Exploited to Gain Root

11:20 Chrome 149 Ships Record Browser Security Update

13:20 Miasma Worm Targets Developer Workflows and AI Coding Tools

Story Links:

• Kirki Password Reset Exploit Goes Live
• UpdraftPlus UpdraftCentral Auth Bypass to RCE
• Check Point VPN Zero-Day Exploited by Qilin Ransomware Affiliate
• Cisco SD-WAN Manager Zero-Day Exploited to Gain Root
• Chrome 149 Ships Record Browser Security Update
• Miasma Worm Targets Developer Workflows and AI Coding Tools

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

This week in Wordfence Security News (Week of June 1, 2026):

• WP Maps Pro flaw lets unauthenticated attackers forge admin accounts; exploitation began May 19th, before public disclosure.
• Palo Alto PAN-OS GlobalProtect authentication bypass under active attack; CISA added it to KEV with a June 1st federal patch deadline.
• FortiClient EMS exploited post-patch to push EKZ infostealer disguised as a Fortinet update to managed endpoints.
• Sysdig documented the first captured intrusion where an LLM agent drove post-compromise activity in real time via unpatched Marimo.
• Flowise one-click RCE lets a malicious chatflow execute code on import; self-hosted installs at risk via STDIO MCP execution path.

Timestamps:

0:00 Introduction

0:34 WP Maps Pro Unauthenticated Admin Account Creation (CVE-2026-8732)

3:00 Palo Alto PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257)

5:36 FortiClient EMS Exploited to Deliver EKZ Infostealer (CVE-2026-35616)

7:11 First Documented LLM-Agent-Driven Intrusion (Marimo, CVE-2026-39987)

9:32 Flowise One-Click RCE and the MCP stdio Execution Problem (CVE-2026-40933)

Story Links:

• WP Maps Pro Unauthenticated Admin Account Creation (CVE-2026-8732)
• Palo Alto PAN-OS GlobalProtect Authentication Bypass (CVE-2026-0257)
• FortiClient EMS Exploited to Deliver EKZ Infostealer (CVE-2026-35616)
• First Documented LLM-Agent-Driven Intrusion (Marimo, CVE-2026-39987)
• Flowise One-Click RCE and the MCP stdio Execution Problem (CVE-2026-40933)

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

This week in Wordfence Security News (Week of May 25, 2025):

• WooCommerce Custom Product Add-ons Pro RCE flaw (CVE-2026-4001) is under active attack, with exploit attempts spiking May 23-27 against the 21,000-install plugin.
• Drupal Core SQL injection (CVE-2026-9082) hit 6,000 sites across 65 countries within 48 hours of patch release, with attackers exploiting PostgreSQL-backend installs.
• Microsoft issued emergency out-of-band Defender patches for two exploited zero-days - RedSun and UnDefend - after a researcher published proof-of-concept exploits without coordinated disclosure.
• Over 700 Ghost CMS sites were compromised via a ClickFix campaign exploiting a SQL injection flaw discovered by Claude Opus 4.6 during Anthropic security testing.
• TrapDoor cross-ecosystem supply chain campaign spread across NPM, PyPI, and Crates.io with 34-plus malicious packages stealing SSH keys, cloud credentials, and crypto wallet data.
• Iranian state-aligned Nimbus Manticore ran three campaign waves since late February, deploying a new AI-assisted MiniFast backdoor via phishing, trojanized Zoom installers, and search engine poisoning.

Timestamps:

0:00 Introduction

0:31 WooCommerce Custom Product Add-ons Pro RCE Active Exploitation

2:06 Drupal Core SQL Injection Active Exploitation

4:37 Microsoft Defender RedSun and UnDefend Zero-Days

7:11 Ghost CMS ClickFix Campaign

9:43 TrapDoor Cross-Ecosystem Supply Chain Campaign

11:43 Nimbus Manticore AI-Assisted MiniFast Backdoor

Story Links:

• WooCommerce Custom Product Addons Pro RCE (CVE-2026-4001)
• Drupal Core SQL Injection (CVE-2026-9082)
• Microsoft Defender RedSun and UnDefend Zero-Days (CVE-2026-41091, CVE-2026-45498)
• Ghost CMS ClickFix Campaign (CVE-2026-26980)
• TrapDoor Cross-Ecosystem Supply Chain Campaign
• Nimbus Manticore AI-Assisted MiniFast Backdoor

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• Burst Statistics plugin auth bypass lets unauthenticated attackers impersonate admins; Wordfence blocked 88,000+ requests across 376 sites.
• Microsoft Exchange OWA zero-day XSS flaw under active exploitation with no permanent patch; CISA deadline set for May 29th.
• Cisco Catalyst SD-WAN auth bypass exploited by UAT-8616; CISA gave federal agencies three days to patch under Emergency Directive 26-03.
• ChromaDB pre-auth RCE loads attacker-controlled AI models before the auth check runs; 73% of exposed instances run a vulnerable version.
• Shai-Hulud worm source code released on GitHub by TeamPCP; copycat packages appeared on NPM within days of publication.
• node-ipc npm package with 800,000 weekly downloads was compromised via an attacker re-registering a maintainer's expired email domain.

Timestamps:

0:00 Introduction
0:37 Burst Statistics Auth Bypass Threatens 200K WordPress Sites
2:52 Microsoft Exchange OWA Zero-Day Under Active Exploitation
5:24 Critical Cisco Catalyst SD-WAN Controller Auth Bypass Under Attack
7:11 ChromaDB Pre-Auth RCE Allows AI Vector Database Server Takeover
9:24 Shai-Hulud Worm Source Code Released on GitHub
11:02 node-ipc npm Package Compromised via Expired Maintainer Domain

Story Links:

• Burst Statistics Auth Bypass Threatens 200K WordPress Sites: https://www.wordfence.com/blog/2026/05/200000-wordpress-sites-at-risk-from-critical-authentication-bypass-vulnerability-in-burst-statistics-plugin/
• Microsoft Exchange OWA Zero-Day Under Active Exploitation: https://techcommunity.microsoft.com/blog/exchange/addressing-exchange-server-may-2026-vulnerability-cve-2026-42897/4518498
• Critical Cisco Catalyst SD-WAN Controller Auth Bypass Under Attack: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-rpa2-v69WY2SW
• ChromaDB Pre-Auth RCE Allows AI Vector Database Server Takeover: https://www.hiddenlayer.com/research/chromatoast-served-pre-auth
• Shai-Hulud Worm Source Code Released on GitHub: https://www.ox.security/blog/shai-hulud-open-source-malware-github/
• node-ipc npm Package Compromised via Expired Maintainer Domain: https://www.bleepingcomputer.com/news/security/popular-node-ipc-npm-package-compromised-to-steal-credentials/

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• Active mass exploitation of an information disclosure vulnerability in Gravity SMTP exposes API keys and mail service credentials, with the Wordfence firewall blocking nearly 788,000 exploit attempts across more than 77,000 unique WordPress sites
• A critical authentication bypass in cPanel and WHM is now under active exploitation, allowing unauthenticated attackers to gain administrative access and potentially compromising every WordPress site on a shared host
• Suspected state-sponsored attackers exploit a Palo Alto PAN-OS zero-day buffer overflow in the User ID Authentication Portal, achieving root code execution on PA series and VM series firewalls and pivoting via high-availability failover
• The Shai-Hulud supply chain worm returns as attackers hijack TanStack's GitHub Actions release pipeline, publishing over 170 malicious packages across NPM and PyPI with valid signatures and provenance attestations
• Google's Threat Intelligence group identifies the first zero-day exploit believed to have been developed with AI assistance, targeting a two-factor authentication bypass in an unnamed open source web administration tool
• A Linux kernel privilege escalation vulnerability called Dirty Frag becomes public after its coordinated disclosure embargo collapses, with Microsoft Defender reporting limited in-the-wild exploitation for root escalation after SSH access

Timestamps:

0:00 Introduction
0:33 Gravity SMTP Information Disclosure Exploitation
3:19 cPanel and WHM Authentication Bypass
4:22 Palo Alto PAN-OS Zero-Day
5:56 Shai-Hulud Supply Chain Worm Hits TanStack
7:09 Google Identifies First AI-Assisted Zero-Day
8:24 Dirty Frag Linux Kernel Privilege Escalation

Story Links:

• Gravity SMTP Exploited at Scale: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/gravitysmtp/gravity-smtp-214-unauthenticated-sensitive-information-exposure-via-rest-api
• PAN-OS zero-day: https://security.paloaltonetworks.com/CVE-2026-0300
• Mini Shai-Hulud worm: https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised
• Google GTIG AI zero-day: https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access
• DirtyFrag Linux LPE: https://github.com/V4bel/dirtyfrag

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• A critical unauthenticated arbitrary file upload vulnerability in BreezeCache, a caching plugin with over 400,000 active installations, went from disclosure to mass exploitation in under 24 hours with over 22,000 exploit attempts blocked across nearly 5,000 sites
• Attackers published a malicious version of the Bitwarden CLI package on NPM that harvested credentials from six different sources including SSH keys, cloud secret stores, and AI assistant configs during a 93-minute window before removal
• The Bitwarden supply chain attack connects to a broader campaign targeting Checkmarx, with Team PCP claiming responsibility and links to the Shai-Hulud self-propagating NPM worm from 2025
• Home security giant ADT confirmed a data breach after ShinyHunters listed the company on its leak site, with Have I Been Pwned tracking 5.5 million unique email addresses tied to the breach
• ShinyHunters used a voice phishing attack to compromise an ADT employee's Okta SSO account and pivot to Salesforce, highlighting why phishing-resistant MFA like FIDO2 or WebAuthn is critical over SMS or TOTP
• A 12-year-old privilege escalation vulnerability dubbed Pack2TheRoot in PackageKit lets any local unprivileged user install arbitrary packages as root, affecting Ubuntu, Debian, Fedora, and Rocky Linux since 2014

Timestamps:

0:00 Introduction
0:34 BreezeCache Critical File Upload Vulnerability and Mass Exploitation
3:50 Bitwarden CLI Supply Chain Attack via NPM
6:25 ADT Data Breach by ShinyHunters
7:49 Why Phishing-Resistant MFA Matters
8:54 PackageKit Privilege Escalation Vulnerability

Story Links:

• Breeze Cache — Active Exploitation (CVE-2026-3844): https://www.wordfence.com/threat-intel/vulnerabilities/id/e342b1c0-6e7f-4e2c-8a52-018df12c12a0
• Bitwarden CLI Compromised in Checkmarx Supply Chain Attack: https://thehackernews.com/2026/04/bitwarden-cli-compromised-in-ongoing.html
• SharePoint Patching Laggards — CVE-2026-32201: https://www.bleepingcomputer.com/news/security/over-1-300-microsoft-sharepoint-servers-vulnerable-to-ongoing-attacks/
• ADT Confirmed in ShinyHunters Breach: https://www.bleepingcomputer.com/news/security/adt-confirms-data-breach-after-shinyhunters-leak-threat/
• Pack2TheRoot — 12-Year-Old PackageKit Privilege Escalation (CVE-2026-41651): https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• Over 30 WordPress plugins purchased on the Flippa marketplace were turned into backdoors that sat dormant for eight months before activating to inject SEO spam into wp-config.php, visible only to Googlebot
• Smart Slider 3 Pro's update infrastructure was compromised, pushing a weaponized build through the official update channel for approximately six hours before being caught
• Microsoft's second-largest Patch Tuesday ever fixes roughly 165 vulnerabilities including a SharePoint spoofing zero-day already under active exploitation and a Defender privilege escalation zero-day linked to the BlueHammer public exploit
• Adobe released an emergency patch for an Acrobat Reader zero-day exploited in the wild since late 2025, discovered via malicious Russian-language PDFs about gas supply disruptions
• ShinyHunters extortion group listed Rockstar Games on its leak site after stealing authentication tokens from cloud analytics platform Anadot and accessing Rockstar's connected Snowflake data warehouse
• A critical pre-authentication remote code execution flaw in Marimo, an open-source Python notebook platform, was exploited within 10 hours of its advisory being published with no public proof of concept

Timestamps:

0:00 Introduction
0:26 Supply Chain Attack on 30+ Essential Plugin WordPress Plugins
2:08 Smart Slider 3 Pro Update Infrastructure Compromised
2:55 Kali Forms and Ninja Forms File Upload Exploitation Updates
3:21 Microsoft Patch Tuesday with SharePoint and Defender Zero-Days
5:31 Adobe Acrobat Reader Zero-Day Emergency Patch
6:26 ShinyHunters Breach of Rockstar Games via Anadot Tokens
7:16 Marimo RCE Exploited Within 10 Hours of Disclosure

Story Links:

• 30+ Plugins Backdoored After Flippa Acquisition: https://anchor.host/someone-bought-30-wordpress-plugins-and-planted-a-backdoor-in-all-of-them/
• Smart Slider 3 Pro — Supply Chain Compromise: https://smartslider.helpscoutdocs.com/article/2144-wordpress-security-advisory-smart-slider-3-pro-3-5-1-35-compromise
• Kali Forms exploitation update: https://www.wordfence.com/blog/2026/04/attackers-actively-exploiting-critical-vulnerability-in-kali-forms-plugin/
• Ninja Forms File Upload exploitation update: https://www.wordfence.com/blog/2026/04/50000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-ninja-forms-file-upload-wordpress-plugin/
• April Patch Tuesday — SharePoint Zero-Day Exploited: https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2026-patch-tuesday-fixes-167-flaws-2-zero-days/
• BlueHammer — Defender Zero-Day: https://www.bleepingcomputer.com/news/microsoft/microsoft-april-2026-patch-tuesday-fixes-167-flaws-2-zero-days/
• Adobe Reader Zero-Day — Exploited Since Late 2025: https://helpx.adobe.com/security/products/acrobat/apsb26-43.html
• Rockstar Games Breach via Third-Party Analytics: https://www.bleepingcomputer.com/news/security/stolen-rockstar-games-analytics-data-leaked-by-extortion-gang/
• Marimo RCE — Exploited in Under 10 Hours: https://www.sysdig.com/blog/marimo-oss-python-notebook-rce-from-disclosure-to-exploitation-in-under-10-hours

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• An arbitrary file upload vulnerability in Ninja Forms File Upload puts 50,000+ WordPress sites at risk
• A Fortinet zero-day actively exploited in the wild
• A CERT-EU report reveals a European Commission cloud breach tied to a Trivy supply chain attack — with Cisco source code stolen in the fallout
• Anthropic announces Project Glasswing
• Germany doxes "UNKN," the head of the REvil and GandCrab ransomware gangs

Story Links:

• Ninja Forms File Upload Vulnerability: https://www.wordfence.com/blog/2026/04/50000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-ninja-forms-file-upload-wordpress-plugin/
• Fortinet Advisory: https://fortiguard.fortinet.com/psirt/FG-IR-26-099
• CERT-EU Report: https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain
• Cisco / Trivy Fallout: https://www.bleepingcomputer.com/news/security/cisco-source-code-stolen-in-trivy-linked-dev-environment-breach/
• Anthropic Glasswing Announcement: https://www.anthropic.com/
• Krebs on Security (REvil): https://krebsonsecurity.com/2026/04/germany-doxes-unkn-head-of-ru-ransomware-gangs-revil-gandcrab/

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• Over 200,000 WordPress sites at risk from an unauthenticated arbitrary file move vulnerability in the MW WP Form plugin, allowing full site takeover
• Massive spike in exploitation attempts targeting the Kali Forms RCE vulnerability, with activity increasing over 60x week-over-week
• A major supply chain attack compromises the widely used Axios JavaScript library, distributing backdoored versions to developers worldwide Active exploitation of a critical Citrix NetScaler vulnerability enabling session hijacking and potential full appliance compromise
• European Commission confirms a cloud breach with data theft claims by ShinyHunters
• Cisco internal development environment breached via poisoned Trivy supply chain attack, exposing source code and credentials

Timestamps:

0:00 Introduction
0:30 MW WP Form Vulnerability
1:15 Kali Forms Exploitation Surge
1:55 Axios Supply Chain Attack
3:20 Citrix NetScaler Active Exploitation
4:57 European Commission Breach
5:50 Cisco Dev Environment Breach
6:47 Wrap up discussion

Story Links:

• MW WP Form Vulnerability
• Kali Forms Exploitation Update
• Axios Supply Chain Attack (Wiz)
• Citrix NetScaler Advisory
• European Commission Breach (Bloomberg)
• Cisco / Trivy Supply Chain Attack

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

• Same-day exploitation of a critical RCE vulnerability in the Kali Forms plugin, attackers can achieve full admin takeover with a single request
• Ongoing mass exploitation of the s2Member plugin targeting password reset functionality
• Breaking News: Iran-linked hackers claim breach of FBI Director Kash Patel’s personal email
• A critical Cisco firewall management vulnerability exploited as a zero-day by ransomware actors
• FBI and CISA warn of phishing campaigns targeting messaging app accounts

Timestamps:

0:00 Introduction
0:25 Kali Forms RCE Vulnerability
1:34 s2Member Mass Exploitation
2:20 Breaking News – FBI Email Breach
2:45 Cisco Firewall RCE Exploitation
5:03 Messaging App Phishing Campaigns

Story Links:

• Kali Forms RCE Vulnerability: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/kali-forms/kali-forms-249-unauthenticated-remote-code-execution-via-form-process
• s2Member Exploitation Campaign: https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/s2member/s2member-260127-unauthenticated-privilege-escalation-via-account-takeover
• Cisco Firewall Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh
• Interlock Ransomware Coverage: https://www.ic3.gov/PSA/2026/PSA260320
• Reuters – FBI Email Breach: https://www.reuters.com/world/us/iran-linked-hackers-claim-breach-of-fbi-directors-personal-email-doj-official-2026-03-27/

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

• A critical auth bypass in Tutor LMS Pro exposes 30,000+ WordPress sites — attackers can hijack admin accounts via a Google sign-in flaw
• An unauthenticated SQL injection in Ally (400K+ sites)
• Microsoft Patch Tuesday with ~80 fixes including AI-related exploits
• A max-severity Cisco SD-WAN zero-day exploited since 2023
• Iran-linked group Handala's claimed attack on medical device maker Stryker.

Timestamps:

0:00 Introduction
0:22 Tutor LMS Pro Authentication Bypass
1:31 Ally WordPress Plugin SQL Injection
1:50 Microsoft Patch Tuesday
2:46 Cisco SD-WAN Zero-Day
4:26 Handala Attack on Stryker
5:03 Iranian Drone Strikes on AWS Data Centers

Story Links:

• Tutor LMS Pro Auth Bypass: https://www.wordfence.com/blog/2026/03/30000-wordpress-sites-affected-by-authentication-bypass-vulnerability-in-tutor-lms-pro-wordpress-plugin/
• Ally Plugin SQL Injection: https://www.wordfence.com/blog/2026/03/400000-wordpress-sites-affected-by-unauthenticated-sql-injection-vulnerability-in-ally-wordpress-plugin/
• Microsoft Patch Tuesday: https://msrc.microsoft.com/update-guide/
• Cisco SD-WAN Advisory: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-authbp-qwCX8D4v
• Iran Cyber Retaliation: https://industrialcyber.co/reports/cyber-retaliation-surges-after-us-israel-strikes-on-iran-as-hacktivists-hit-governments-defense-critical-sectors/
• Stryker Cyberattack (WSJ): https://www.wsj.com/articles/stryker-hit-with-suspected-iran-linked-cyberattack-52f6615c
• AWS Data Centers Struck (BBC): https://www.bbc.com/news/articles/cgk28nj0lrjo
• Weekly Vulnerability Report: https://www.wordfence.com/blog/2026/03/wordfence-intelligence-weekly-wordpress-vulnerability-report-march-2-2026-to-march-8-2026/

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.