Wordfence Security News Transistor (https://transistor.fm) https://feeds.transistor.fm/wordfence-security-news Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas. 2012-2026 Defiant Inc. All Rights Reserved 294fd773-073d-5608-bb6d-08964562719f yes en Thu, 04 Jun 2026 11:48:05 -0700 Thu, 04 Jun 2026 11:49:14 -0700 https://www.wordfence.com https://img.transistorcdn.com/Wq_-Nf8t4p9FMeTFUnB2VFtU_MTLRjwTzZznjj5L4hs/rs:fill:0:0:1/w:1400/h:1400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNjZm/M2NiNzczNWQ4MDdh/OTYyMTg5MDQ5ODk3/ODI5ZC5wbmc.jpg Wordfence Security News https://www.wordfence.com episodic Wordfence Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas. Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Wordfence, WordPress, WordPress Security, Cybersecurity Wordfence No No WooCommerce RCE | Drupal SQLi | Ghost CMS Clickfix Attack | Wordfence Security News | May 25, 2026 9 9 WooCommerce RCE | Drupal SQLi | Ghost CMS Clickfix Attack | Wordfence Security News | May 25, 2026 full 70825793-5d79-490f-a827-c27f32296fd1 https://share.transistor.fm/s/08da5955 WooCommerce RCE active exploitation, Drupal SQL injection attacks, Microsoft Defender zero-days, Ghost CMS ClickFix campaign, TrapDoor supply chain, Nimbus Manticore backdoor.


This week in Wordfence Security News (Week of May 25, 2025):


  • WooCommerce Custom Product Add-ons Pro RCE flaw (CVE-2026-4001) is under active attack, with exploit attempts spiking May 23-27 against the 21,000-install plugin.
  • Drupal Core SQL injection (CVE-2026-9082) hit 6,000 sites across 65 countries within 48 hours of patch release, with attackers exploiting PostgreSQL-backend installs.
  • Microsoft issued emergency out-of-band Defender patches for two exploited zero-days - RedSun and UnDefend - after a researcher published proof-of-concept exploits without coordinated disclosure.
  • Over 700 Ghost CMS sites were compromised via a ClickFix campaign exploiting a SQL injection flaw discovered by Claude Opus 4.6 during Anthropic security testing.
  • TrapDoor cross-ecosystem supply chain campaign spread across NPM, PyPI, and Crates.io with 34-plus malicious packages stealing SSH keys, cloud credentials, and crypto wallet data.
  • Iranian state-aligned Nimbus Manticore ran three campaign waves since late February, deploying a new AI-assisted MiniFast backdoor via phishing, trojanized Zoom installers, and search engine poisoning.

Timestamps:


0:00 Introduction

0:31 WooCommerce Custom Product Add-ons Pro RCE Active Exploitation

2:06 Drupal Core SQL Injection Active Exploitation

4:37 Microsoft Defender RedSun and UnDefend Zero-Days

7:11 Ghost CMS ClickFix Campaign

9:43 TrapDoor Cross-Ecosystem Supply Chain Campaign

11:43 Nimbus Manticore AI-Assisted MiniFast Backdoor


Story Links:


Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> WooCommerce RCE active exploitation, Drupal SQL injection attacks, Microsoft Defender zero-days, Ghost CMS ClickFix campaign, TrapDoor supply chain, Nimbus Manticore backdoor.


This week in Wordfence Security News (Week of May 25, 2025):


  • WooCommerce Custom Product Add-ons Pro RCE flaw (CVE-2026-4001) is under active attack, with exploit attempts spiking May 23-27 against the 21,000-install plugin.
  • Drupal Core SQL injection (CVE-2026-9082) hit 6,000 sites across 65 countries within 48 hours of patch release, with attackers exploiting PostgreSQL-backend installs.
  • Microsoft issued emergency out-of-band Defender patches for two exploited zero-days - RedSun and UnDefend - after a researcher published proof-of-concept exploits without coordinated disclosure.
  • Over 700 Ghost CMS sites were compromised via a ClickFix campaign exploiting a SQL injection flaw discovered by Claude Opus 4.6 during Anthropic security testing.
  • TrapDoor cross-ecosystem supply chain campaign spread across NPM, PyPI, and Crates.io with 34-plus malicious packages stealing SSH keys, cloud credentials, and crypto wallet data.
  • Iranian state-aligned Nimbus Manticore ran three campaign waves since late February, deploying a new AI-assisted MiniFast backdoor via phishing, trojanized Zoom installers, and search engine poisoning.

Timestamps:


0:00 Introduction

0:31 WooCommerce Custom Product Add-ons Pro RCE Active Exploitation

2:06 Drupal Core SQL Injection Active Exploitation

4:37 Microsoft Defender RedSun and UnDefend Zero-Days

7:11 Ghost CMS ClickFix Campaign

9:43 TrapDoor Cross-Ecosystem Supply Chain Campaign

11:43 Nimbus Manticore AI-Assisted MiniFast Backdoor


Story Links:


Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Thu, 04 Jun 2026 11:48:05 -0700 Wordfence Wordfence 816 WooCommerce RCE active exploitation, Drupal SQL injection attacks, Microsoft Defender zero-days, Ghost CMS ClickFix campaign, TrapDoor supply chain, Nimbus Manticore backdoor.


This week in Wordfence Security News (Week of May 25, 2025):


  • WooCommerce Custom Product Add-ons Pro RCE flaw (CVE-2026-4001) is under active attack, with exploit attempts spiking May 23-27 against the 21,000-install plugin.
  • Drupal Core SQL injection (CVE-2026-9082) hit 6,000 sites across 65 countries within 48 hours of patch release, with attackers exploiting PostgreSQL-backend installs.
  • Microsoft issued emergency out-of-band Defender patches for two exploited zero-days - RedSun and UnDefend - after a researcher published proof-of-concept exploits without coordinated disclosure.
  • Over 700 Ghost CMS sites were compromised via a ClickFix campaign exploiting a SQL injection flaw discovered by Claude Opus 4.6 during Anthropic security testing.
  • TrapDoor cross-ecosystem supply chain campaign spread across NPM, PyPI, and Crates.io with 34-plus malicious packages stealing SSH keys, cloud credentials, and crypto wallet data.
  • Iranian state-aligned Nimbus Manticore ran three campaign waves since late February, deploying a new AI-assisted MiniFast backdoor via phishing, trojanized Zoom installers, and search engine poisoning.

Timestamps:


0:00 Introduction

0:31 WooCommerce Custom Product Add-ons Pro RCE Active Exploitation

2:06 Drupal Core SQL Injection Active Exploitation

4:37 Microsoft Defender RedSun and UnDefend Zero-Days

7:11 Ghost CMS ClickFix Campaign

9:43 TrapDoor Cross-Ecosystem Supply Chain Campaign

11:43 Nimbus Manticore AI-Assisted MiniFast Backdoor


Story Links:


Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Cybersecurity, WooCommerce, Drupal, Ghost CMS, Clickfix, WordPress, Wordfence Security News No Burst Statistics Bypass Threatens 200,000 WordPress Sites | Microsoft Exchange Zero-Day Under Active Exploitation | Critical Cisco SD-WAN Controller Flaw Exploited | Shai-Hulud Worm Source Code Open-Sourced | Wordfence Security News | Week of May 18, 2026 8 8 Burst Statistics Bypass Threatens 200,000 WordPress Sites | Microsoft Exchange Zero-Day Under Active Exploitation | Critical Cisco SD-WAN Controller Flaw Exploited | Shai-Hulud Worm Source Code Open-Sourced | Wordfence Security News | Week of May 18, 2026 full 1aa0cca5-dceb-4885-8986-74ef1f6ce4d4 https://share.transistor.fm/s/3a70d52d This week in Wordfence Security News (Week of May 18, 2026):

  • Burst Statistics plugin auth bypass lets unauthenticated attackers impersonate admins; Wordfence blocked 88,000+ requests across 376 sites.
  • Microsoft Exchange OWA zero-day XSS flaw under active exploitation with no permanent patch; CISA deadline set for May 29th.
  • Cisco Catalyst SD-WAN auth bypass exploited by UAT-8616; CISA gave federal agencies three days to patch under Emergency Directive 26-03.
  • ChromaDB pre-auth RCE loads attacker-controlled AI models before the auth check runs; 73% of exposed instances run a vulnerable version.
  • Shai-Hulud worm source code released on GitHub by TeamPCP; copycat packages appeared on NPM within days of publication.
  • node-ipc npm package with 800,000 weekly downloads was compromised via an attacker re-registering a maintainer's expired email domain.

Timestamps:

0:00 Introduction
0:37 Burst Statistics Auth Bypass Threatens 200K WordPress Sites
2:52 Microsoft Exchange OWA Zero-Day Under Active Exploitation
5:24 Critical Cisco Catalyst SD-WAN Controller Auth Bypass Under Attack
7:11 ChromaDB Pre-Auth RCE Allows AI Vector Database Server Takeover
9:24 Shai-Hulud Worm Source Code Released on GitHub
11:02 node-ipc npm Package Compromised via Expired Maintainer Domain


Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> This week in Wordfence Security News (Week of May 18, 2026):

  • Burst Statistics plugin auth bypass lets unauthenticated attackers impersonate admins; Wordfence blocked 88,000+ requests across 376 sites.
  • Microsoft Exchange OWA zero-day XSS flaw under active exploitation with no permanent patch; CISA deadline set for May 29th.
  • Cisco Catalyst SD-WAN auth bypass exploited by UAT-8616; CISA gave federal agencies three days to patch under Emergency Directive 26-03.
  • ChromaDB pre-auth RCE loads attacker-controlled AI models before the auth check runs; 73% of exposed instances run a vulnerable version.
  • Shai-Hulud worm source code released on GitHub by TeamPCP; copycat packages appeared on NPM within days of publication.
  • node-ipc npm package with 800,000 weekly downloads was compromised via an attacker re-registering a maintainer's expired email domain.

Timestamps:

0:00 Introduction
0:37 Burst Statistics Auth Bypass Threatens 200K WordPress Sites
2:52 Microsoft Exchange OWA Zero-Day Under Active Exploitation
5:24 Critical Cisco Catalyst SD-WAN Controller Auth Bypass Under Attack
7:11 ChromaDB Pre-Auth RCE Allows AI Vector Database Server Takeover
9:24 Shai-Hulud Worm Source Code Released on GitHub
11:02 node-ipc npm Package Compromised via Expired Maintainer Domain


Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Fri, 22 May 2026 12:12:52 -0700 Wordfence Wordfence 700 This week in Wordfence Security News (Week of May 18, 2026):

  • Burst Statistics plugin auth bypass lets unauthenticated attackers impersonate admins; Wordfence blocked 88,000+ requests across 376 sites.
  • Microsoft Exchange OWA zero-day XSS flaw under active exploitation with no permanent patch; CISA deadline set for May 29th.
  • Cisco Catalyst SD-WAN auth bypass exploited by UAT-8616; CISA gave federal agencies three days to patch under Emergency Directive 26-03.
  • ChromaDB pre-auth RCE loads attacker-controlled AI models before the auth check runs; 73% of exposed instances run a vulnerable version.
  • Shai-Hulud worm source code released on GitHub by TeamPCP; copycat packages appeared on NPM within days of publication.
  • node-ipc npm package with 800,000 weekly downloads was compromised via an attacker re-registering a maintainer's expired email domain.

Timestamps:

0:00 Introduction
0:37 Burst Statistics Auth Bypass Threatens 200K WordPress Sites
2:52 Microsoft Exchange OWA Zero-Day Under Active Exploitation
5:24 Critical Cisco Catalyst SD-WAN Controller Auth Bypass Under Attack
7:11 ChromaDB Pre-Auth RCE Allows AI Vector Database Server Takeover
9:24 Shai-Hulud Worm Source Code Released on GitHub
11:02 node-ipc npm Package Compromised via Expired Maintainer Domain


Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Wordfence, WordPress, WordPress Security, Cybersecurity No Google Identifies First AI-Developed Zero-Day | Gravity SMTP Mass Exploitation Leaks API Keys | Palo Alto Firewall Flaw Exploited by State Actors | TanStack Release Pipeline Hijacked | Wordfence Security News | Week of May 11, 2026 7 7 Google Identifies First AI-Developed Zero-Day | Gravity SMTP Mass Exploitation Leaks API Keys | Palo Alto Firewall Flaw Exploited by State Actors | TanStack Release Pipeline Hijacked | Wordfence Security News | Week of May 11, 2026 full 14357644-5dad-4ca6-becb-94c4b91ddfc8 https://share.transistor.fm/s/55ee78c9 This week in Wordfence Security News (Week of May 11, 2026):

  • Active mass exploitation of an information disclosure vulnerability in Gravity SMTP exposes API keys and mail service credentials, with the Wordfence firewall blocking nearly 788,000 exploit attempts across more than 77,000 unique WordPress sites
  • A critical authentication bypass in cPanel and WHM is now under active exploitation, allowing unauthenticated attackers to gain administrative access and potentially compromising every WordPress site on a shared host
  • Suspected state-sponsored attackers exploit a Palo Alto PAN-OS zero-day buffer overflow in the User ID Authentication Portal, achieving root code execution on PA series and VM series firewalls and pivoting via high-availability failover
  • The Shai-Hulud supply chain worm returns as attackers hijack TanStack's GitHub Actions release pipeline, publishing over 170 malicious packages across NPM and PyPI with valid signatures and provenance attestations
  • Google's Threat Intelligence group identifies the first zero-day exploit believed to have been developed with AI assistance, targeting a two-factor authentication bypass in an unnamed open source web administration tool
  • A Linux kernel privilege escalation vulnerability called Dirty Frag becomes public after its coordinated disclosure embargo collapses, with Microsoft Defender reporting limited in-the-wild exploitation for root escalation after SSH access

Timestamps:

0:00 Introduction
0:33 Gravity SMTP Information Disclosure Exploitation
3:19 cPanel and WHM Authentication Bypass
4:22 Palo Alto PAN-OS Zero-Day
5:56 Shai-Hulud Supply Chain Worm Hits TanStack
7:09 Google Identifies First AI-Assisted Zero-Day
8:24 Dirty Frag Linux Kernel Privilege Escalation

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> This week in Wordfence Security News (Week of May 11, 2026):

  • Active mass exploitation of an information disclosure vulnerability in Gravity SMTP exposes API keys and mail service credentials, with the Wordfence firewall blocking nearly 788,000 exploit attempts across more than 77,000 unique WordPress sites
  • A critical authentication bypass in cPanel and WHM is now under active exploitation, allowing unauthenticated attackers to gain administrative access and potentially compromising every WordPress site on a shared host
  • Suspected state-sponsored attackers exploit a Palo Alto PAN-OS zero-day buffer overflow in the User ID Authentication Portal, achieving root code execution on PA series and VM series firewalls and pivoting via high-availability failover
  • The Shai-Hulud supply chain worm returns as attackers hijack TanStack's GitHub Actions release pipeline, publishing over 170 malicious packages across NPM and PyPI with valid signatures and provenance attestations
  • Google's Threat Intelligence group identifies the first zero-day exploit believed to have been developed with AI assistance, targeting a two-factor authentication bypass in an unnamed open source web administration tool
  • A Linux kernel privilege escalation vulnerability called Dirty Frag becomes public after its coordinated disclosure embargo collapses, with Microsoft Defender reporting limited in-the-wild exploitation for root escalation after SSH access

Timestamps:

0:00 Introduction
0:33 Gravity SMTP Information Disclosure Exploitation
3:19 cPanel and WHM Authentication Bypass
4:22 Palo Alto PAN-OS Zero-Day
5:56 Shai-Hulud Supply Chain Worm Hits TanStack
7:09 Google Identifies First AI-Assisted Zero-Day
8:24 Dirty Frag Linux Kernel Privilege Escalation

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Fri, 15 May 2026 17:13:28 -0700 Wordfence Wordfence 608 This week in Wordfence Security News (Week of May 11, 2026):

  • Active mass exploitation of an information disclosure vulnerability in Gravity SMTP exposes API keys and mail service credentials, with the Wordfence firewall blocking nearly 788,000 exploit attempts across more than 77,000 unique WordPress sites
  • A critical authentication bypass in cPanel and WHM is now under active exploitation, allowing unauthenticated attackers to gain administrative access and potentially compromising every WordPress site on a shared host
  • Suspected state-sponsored attackers exploit a Palo Alto PAN-OS zero-day buffer overflow in the User ID Authentication Portal, achieving root code execution on PA series and VM series firewalls and pivoting via high-availability failover
  • The Shai-Hulud supply chain worm returns as attackers hijack TanStack's GitHub Actions release pipeline, publishing over 170 malicious packages across NPM and PyPI with valid signatures and provenance attestations
  • Google's Threat Intelligence group identifies the first zero-day exploit believed to have been developed with AI assistance, targeting a two-factor authentication bypass in an unnamed open source web administration tool
  • A Linux kernel privilege escalation vulnerability called Dirty Frag becomes public after its coordinated disclosure embargo collapses, with Microsoft Defender reporting limited in-the-wild exploitation for root escalation after SSH access

Timestamps:

0:00 Introduction
0:33 Gravity SMTP Information Disclosure Exploitation
3:19 cPanel and WHM Authentication Bypass
4:22 Palo Alto PAN-OS Zero-Day
5:56 Shai-Hulud Supply Chain Worm Hits TanStack
7:09 Google Identifies First AI-Assisted Zero-Day
8:24 Dirty Frag Linux Kernel Privilege Escalation

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Wordfence, WordPress, WordPress Security, Cybersecurity No Breeze Cache Mass Exploitation in 24 Hours | Bitwarden CLI Supply Chain Attack | ADT Confirmed in ShinyHunters Breach | Pack2TheRoot 12-Year-Old PackageKit Privilege Escalation (CVE-2026-41651) | Wordfence Security News | Week of April 27, 2026 6 6 Breeze Cache Mass Exploitation in 24 Hours | Bitwarden CLI Supply Chain Attack | ADT Confirmed in ShinyHunters Breach | Pack2TheRoot 12-Year-Old PackageKit Privilege Escalation (CVE-2026-41651) | Wordfence Security News | Week of April 27, 2026 full bfe2b51b-9a74-43df-9c57-44587cffae87 https://share.transistor.fm/s/84b1ca75 This week in Wordfence Security News (Week of Apr 27, 2026):

  • A critical unauthenticated arbitrary file upload vulnerability in BreezeCache, a caching plugin with over 400,000 active installations, went from disclosure to mass exploitation in under 24 hours with over 22,000 exploit attempts blocked across nearly 5,000 sites
  • Attackers published a malicious version of the Bitwarden CLI package on NPM that harvested credentials from six different sources including SSH keys, cloud secret stores, and AI assistant configs during a 93-minute window before removal
  • The Bitwarden supply chain attack connects to a broader campaign targeting Checkmarx, with Team PCP claiming responsibility and links to the Shai-Hulud self-propagating NPM worm from 2025
  • Home security giant ADT confirmed a data breach after ShinyHunters listed the company on its leak site, with Have I Been Pwned tracking 5.5 million unique email addresses tied to the breach
  • ShinyHunters used a voice phishing attack to compromise an ADT employee's Okta SSO account and pivot to Salesforce, highlighting why phishing-resistant MFA like FIDO2 or WebAuthn is critical over SMS or TOTP
  • A 12-year-old privilege escalation vulnerability dubbed Pack2TheRoot in PackageKit lets any local unprivileged user install arbitrary packages as root, affecting Ubuntu, Debian, Fedora, and Rocky Linux since 2014

Timestamps:

0:00 Introduction
0:34 BreezeCache Critical File Upload Vulnerability and Mass Exploitation
3:50 Bitwarden CLI Supply Chain Attack via NPM
6:25 ADT Data Breach by ShinyHunters
7:49 Why Phishing-Resistant MFA Matters
8:54 PackageKit Privilege Escalation Vulnerability

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> This week in Wordfence Security News (Week of Apr 27, 2026):

  • A critical unauthenticated arbitrary file upload vulnerability in BreezeCache, a caching plugin with over 400,000 active installations, went from disclosure to mass exploitation in under 24 hours with over 22,000 exploit attempts blocked across nearly 5,000 sites
  • Attackers published a malicious version of the Bitwarden CLI package on NPM that harvested credentials from six different sources including SSH keys, cloud secret stores, and AI assistant configs during a 93-minute window before removal
  • The Bitwarden supply chain attack connects to a broader campaign targeting Checkmarx, with Team PCP claiming responsibility and links to the Shai-Hulud self-propagating NPM worm from 2025
  • Home security giant ADT confirmed a data breach after ShinyHunters listed the company on its leak site, with Have I Been Pwned tracking 5.5 million unique email addresses tied to the breach
  • ShinyHunters used a voice phishing attack to compromise an ADT employee's Okta SSO account and pivot to Salesforce, highlighting why phishing-resistant MFA like FIDO2 or WebAuthn is critical over SMS or TOTP
  • A 12-year-old privilege escalation vulnerability dubbed Pack2TheRoot in PackageKit lets any local unprivileged user install arbitrary packages as root, affecting Ubuntu, Debian, Fedora, and Rocky Linux since 2014

Timestamps:

0:00 Introduction
0:34 BreezeCache Critical File Upload Vulnerability and Mass Exploitation
3:50 Bitwarden CLI Supply Chain Attack via NPM
6:25 ADT Data Breach by ShinyHunters
7:49 Why Phishing-Resistant MFA Matters
8:54 PackageKit Privilege Escalation Vulnerability

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Mon, 04 May 2026 13:02:37 -0700 Wordfence Wordfence 624 This week in Wordfence Security News (Week of Apr 27, 2026):

  • A critical unauthenticated arbitrary file upload vulnerability in BreezeCache, a caching plugin with over 400,000 active installations, went from disclosure to mass exploitation in under 24 hours with over 22,000 exploit attempts blocked across nearly 5,000 sites
  • Attackers published a malicious version of the Bitwarden CLI package on NPM that harvested credentials from six different sources including SSH keys, cloud secret stores, and AI assistant configs during a 93-minute window before removal
  • The Bitwarden supply chain attack connects to a broader campaign targeting Checkmarx, with Team PCP claiming responsibility and links to the Shai-Hulud self-propagating NPM worm from 2025
  • Home security giant ADT confirmed a data breach after ShinyHunters listed the company on its leak site, with Have I Been Pwned tracking 5.5 million unique email addresses tied to the breach
  • ShinyHunters used a voice phishing attack to compromise an ADT employee's Okta SSO account and pivot to Salesforce, highlighting why phishing-resistant MFA like FIDO2 or WebAuthn is critical over SMS or TOTP
  • A 12-year-old privilege escalation vulnerability dubbed Pack2TheRoot in PackageKit lets any local unprivileged user install arbitrary packages as root, affecting Ubuntu, Debian, Fedora, and Rocky Linux since 2014

Timestamps:

0:00 Introduction
0:34 BreezeCache Critical File Upload Vulnerability and Mass Exploitation
3:50 Bitwarden CLI Supply Chain Attack via NPM
6:25 ADT Data Breach by ShinyHunters
7:49 Why Phishing-Resistant MFA Matters
8:54 PackageKit Privilege Escalation Vulnerability

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Wordfence, WordPress, WordPress Security, Cybersecurity No WordPress 30+ Plugin Supply Chain Attack | Wordfence Security News | Week of April 13, 2026 5 5 WordPress 30+ Plugin Supply Chain Attack | Wordfence Security News | Week of April 13, 2026 full 056a29cd-c015-42cc-9bdc-992c54a63a6c https://share.transistor.fm/s/170d5314 This week in Wordfence Security News (Week of Apr 13, 2026):

  • Over 30 WordPress plugins purchased on the Flippa marketplace were turned into backdoors that sat dormant for eight months before activating to inject SEO spam into wp-config.php, visible only to Googlebot
  • Smart Slider 3 Pro's update infrastructure was compromised, pushing a weaponized build through the official update channel for approximately six hours before being caught
  • Microsoft's second-largest Patch Tuesday ever fixes roughly 165 vulnerabilities including a SharePoint spoofing zero-day already under active exploitation and a Defender privilege escalation zero-day linked to the BlueHammer public exploit
  • Adobe released an emergency patch for an Acrobat Reader zero-day exploited in the wild since late 2025, discovered via malicious Russian-language PDFs about gas supply disruptions
  • ShinyHunters extortion group listed Rockstar Games on its leak site after stealing authentication tokens from cloud analytics platform Anadot and accessing Rockstar's connected Snowflake data warehouse
  • A critical pre-authentication remote code execution flaw in Marimo, an open-source Python notebook platform, was exploited within 10 hours of its advisory being published with no public proof of concept

Timestamps:

0:00 Introduction
0:26 Supply Chain Attack on 30+ Essential Plugin WordPress Plugins
2:08 Smart Slider 3 Pro Update Infrastructure Compromised
2:55 Kali Forms and Ninja Forms File Upload Exploitation Updates
3:21 Microsoft Patch Tuesday with SharePoint and Defender Zero-Days
5:31 Adobe Acrobat Reader Zero-Day Emergency Patch
6:26 ShinyHunters Breach of Rockstar Games via Anadot Tokens
7:16 Marimo RCE Exploited Within 10 Hours of Disclosure

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> This week in Wordfence Security News (Week of Apr 13, 2026):

  • Over 30 WordPress plugins purchased on the Flippa marketplace were turned into backdoors that sat dormant for eight months before activating to inject SEO spam into wp-config.php, visible only to Googlebot
  • Smart Slider 3 Pro's update infrastructure was compromised, pushing a weaponized build through the official update channel for approximately six hours before being caught
  • Microsoft's second-largest Patch Tuesday ever fixes roughly 165 vulnerabilities including a SharePoint spoofing zero-day already under active exploitation and a Defender privilege escalation zero-day linked to the BlueHammer public exploit
  • Adobe released an emergency patch for an Acrobat Reader zero-day exploited in the wild since late 2025, discovered via malicious Russian-language PDFs about gas supply disruptions
  • ShinyHunters extortion group listed Rockstar Games on its leak site after stealing authentication tokens from cloud analytics platform Anadot and accessing Rockstar's connected Snowflake data warehouse
  • A critical pre-authentication remote code execution flaw in Marimo, an open-source Python notebook platform, was exploited within 10 hours of its advisory being published with no public proof of concept

Timestamps:

0:00 Introduction
0:26 Supply Chain Attack on 30+ Essential Plugin WordPress Plugins
2:08 Smart Slider 3 Pro Update Infrastructure Compromised
2:55 Kali Forms and Ninja Forms File Upload Exploitation Updates
3:21 Microsoft Patch Tuesday with SharePoint and Defender Zero-Days
5:31 Adobe Acrobat Reader Zero-Day Emergency Patch
6:26 ShinyHunters Breach of Rockstar Games via Anadot Tokens
7:16 Marimo RCE Exploited Within 10 Hours of Disclosure

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Fri, 17 Apr 2026 14:18:02 -0700 Wordfence Wordfence 489 This week in Wordfence Security News (Week of Apr 13, 2026):

  • Over 30 WordPress plugins purchased on the Flippa marketplace were turned into backdoors that sat dormant for eight months before activating to inject SEO spam into wp-config.php, visible only to Googlebot
  • Smart Slider 3 Pro's update infrastructure was compromised, pushing a weaponized build through the official update channel for approximately six hours before being caught
  • Microsoft's second-largest Patch Tuesday ever fixes roughly 165 vulnerabilities including a SharePoint spoofing zero-day already under active exploitation and a Defender privilege escalation zero-day linked to the BlueHammer public exploit
  • Adobe released an emergency patch for an Acrobat Reader zero-day exploited in the wild since late 2025, discovered via malicious Russian-language PDFs about gas supply disruptions
  • ShinyHunters extortion group listed Rockstar Games on its leak site after stealing authentication tokens from cloud analytics platform Anadot and accessing Rockstar's connected Snowflake data warehouse
  • A critical pre-authentication remote code execution flaw in Marimo, an open-source Python notebook platform, was exploited within 10 hours of its advisory being published with no public proof of concept

Timestamps:

0:00 Introduction
0:26 Supply Chain Attack on 30+ Essential Plugin WordPress Plugins
2:08 Smart Slider 3 Pro Update Infrastructure Compromised
2:55 Kali Forms and Ninja Forms File Upload Exploitation Updates
3:21 Microsoft Patch Tuesday with SharePoint and Defender Zero-Days
5:31 Adobe Acrobat Reader Zero-Day Emergency Patch
6:26 ShinyHunters Breach of Rockstar Games via Anadot Tokens
7:16 Marimo RCE Exploited Within 10 Hours of Disclosure

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Wordfence, WordPress, WordPress Security, Cybersecurity No 50,000 Site Ninja Forms File Upload Vulnerability | Anthropic Project Glasswing | Fortinet Zero Day | Wordfence Security News | April 6 2026 4 4 50,000 Site Ninja Forms File Upload Vulnerability | Anthropic Project Glasswing | Fortinet Zero Day | Wordfence Security News | April 6 2026 full 643fca4d-7d3c-463f-b8a2-b323d27469ff https://share.transistor.fm/s/48f55f81 This week in Wordfence Security News (Week of Apr 6, 2026):

  • An arbitrary file upload vulnerability in Ninja Forms File Upload puts 50,000+ WordPress sites at risk
  • A Fortinet zero-day actively exploited in the wild
  • A CERT-EU report reveals a European Commission cloud breach tied to a Trivy supply chain attack — with Cisco source code stolen in the fallout
  • Anthropic announces Project Glasswing
  • Germany doxes "UNKN," the head of the REvil and GandCrab ransomware gangs

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> This week in Wordfence Security News (Week of Apr 6, 2026):

  • An arbitrary file upload vulnerability in Ninja Forms File Upload puts 50,000+ WordPress sites at risk
  • A Fortinet zero-day actively exploited in the wild
  • A CERT-EU report reveals a European Commission cloud breach tied to a Trivy supply chain attack — with Cisco source code stolen in the fallout
  • Anthropic announces Project Glasswing
  • Germany doxes "UNKN," the head of the REvil and GandCrab ransomware gangs

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Fri, 10 Apr 2026 13:15:36 -0700 Wordfence Wordfence 415 This week in Wordfence Security News (Week of Apr 6, 2026):

  • An arbitrary file upload vulnerability in Ninja Forms File Upload puts 50,000+ WordPress sites at risk
  • A Fortinet zero-day actively exploited in the wild
  • A CERT-EU report reveals a European Commission cloud breach tied to a Trivy supply chain attack — with Cisco source code stolen in the fallout
  • Anthropic announces Project Glasswing
  • Germany doxes "UNKN," the head of the REvil and GandCrab ransomware gangs

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

]]> Wordfence, WordPress, WordPress Security, Cybersecurity No MW WP Form 200K Sites at Risk | Axios Hack | Cisco Breach | Wordfence Security News | March 30, 2026 3 3 MW WP Form 200K Sites at Risk | Axios Hack | Cisco Breach | Wordfence Security News | March 30, 2026 full 4ae3b264-9506-47d0-94db-896a7a593cb7 https://share.transistor.fm/s/3e16c17d This week in Wordfence Security News (Week of Mar 30, 2026): 

  • Over 200,000 WordPress sites at risk from an unauthenticated arbitrary file move vulnerability in the MW WP Form plugin, allowing full site takeover
  • Massive spike in exploitation attempts targeting the Kali Forms RCE vulnerability, with activity increasing over 60x week-over-week
  • A major supply chain attack compromises the widely used Axios JavaScript library, distributing backdoored versions to developers worldwide Active exploitation of a critical Citrix NetScaler vulnerability enabling session hijacking and potential full appliance compromise
  • European Commission confirms a cloud breach with data theft claims by ShinyHunters
  • Cisco internal development environment breached via poisoned Trivy supply chain attack, exposing source code and credentials

Timestamps:

0:00 Introduction
0:30 MW WP Form Vulnerability
1:15 Kali Forms Exploitation Surge
1:55 Axios Supply Chain Attack
3:20 Citrix NetScaler Active Exploitation
4:57 European Commission Breach
5:50 Cisco Dev Environment Breach
6:47 Wrap up discussion

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

]]> This week in Wordfence Security News (Week of Mar 30, 2026): 

  • Over 200,000 WordPress sites at risk from an unauthenticated arbitrary file move vulnerability in the MW WP Form plugin, allowing full site takeover
  • Massive spike in exploitation attempts targeting the Kali Forms RCE vulnerability, with activity increasing over 60x week-over-week
  • A major supply chain attack compromises the widely used Axios JavaScript library, distributing backdoored versions to developers worldwide Active exploitation of a critical Citrix NetScaler vulnerability enabling session hijacking and potential full appliance compromise
  • European Commission confirms a cloud breach with data theft claims by ShinyHunters
  • Cisco internal development environment breached via poisoned Trivy supply chain attack, exposing source code and credentials

Timestamps:

0:00 Introduction
0:30 MW WP Form Vulnerability
1:15 Kali Forms Exploitation Surge
1:55 Axios Supply Chain Attack
3:20 Citrix NetScaler Active Exploitation
4:57 European Commission Breach
5:50 Cisco Dev Environment Breach
6:47 Wrap up discussion

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

]]> Fri, 03 Apr 2026 12:15:22 -0700 Wordfence Wordfence 442 This week in Wordfence Security News (Week of Mar 30, 2026): 

  • Over 200,000 WordPress sites at risk from an unauthenticated arbitrary file move vulnerability in the MW WP Form plugin, allowing full site takeover
  • Massive spike in exploitation attempts targeting the Kali Forms RCE vulnerability, with activity increasing over 60x week-over-week
  • A major supply chain attack compromises the widely used Axios JavaScript library, distributing backdoored versions to developers worldwide Active exploitation of a critical Citrix NetScaler vulnerability enabling session hijacking and potential full appliance compromise
  • European Commission confirms a cloud breach with data theft claims by ShinyHunters
  • Cisco internal development environment breached via poisoned Trivy supply chain attack, exposing source code and credentials

Timestamps:

0:00 Introduction
0:30 MW WP Form Vulnerability
1:15 Kali Forms Exploitation Surge
1:55 Axios Supply Chain Attack
3:20 Citrix NetScaler Active Exploitation
4:57 European Commission Breach
5:50 Cisco Dev Environment Breach
6:47 Wrap up discussion

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

]]> Wordfence, WordPress, WordPress Security, Cybersecurity No Iran-Linked Hackers Breach FBI Director's Email | Wordfence Security News| Week of March 23, 2026 2 2 Iran-Linked Hackers Breach FBI Director's Email | Wordfence Security News| Week of March 23, 2026 full 58833c10-09ed-49d3-aaab-152e0e62aa9e https://share.transistor.fm/s/d9a87871 This week in Wordfence Security News (Week of Mar 23, 2026): 

  • Same-day exploitation of a critical RCE vulnerability in the Kali Forms plugin, attackers can achieve full admin takeover with a single request
  • Ongoing mass exploitation of the s2Member plugin targeting password reset functionality
  • Breaking News: Iran-linked hackers claim breach of FBI Director Kash Patel’s personal email
  • A critical Cisco firewall management vulnerability exploited as a zero-day by ransomware actors
  • FBI and CISA warn of phishing campaigns targeting messaging app accounts

Timestamps:

0:00 Introduction
0:25 Kali Forms RCE Vulnerability
1:34 s2Member Mass Exploitation
2:20 Breaking News – FBI Email Breach
2:45 Cisco Firewall RCE Exploitation
5:03 Messaging App Phishing Campaigns

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

]]> This week in Wordfence Security News (Week of Mar 23, 2026): 

  • Same-day exploitation of a critical RCE vulnerability in the Kali Forms plugin, attackers can achieve full admin takeover with a single request
  • Ongoing mass exploitation of the s2Member plugin targeting password reset functionality
  • Breaking News: Iran-linked hackers claim breach of FBI Director Kash Patel’s personal email
  • A critical Cisco firewall management vulnerability exploited as a zero-day by ransomware actors
  • FBI and CISA warn of phishing campaigns targeting messaging app accounts

Timestamps:

0:00 Introduction
0:25 Kali Forms RCE Vulnerability
1:34 s2Member Mass Exploitation
2:20 Breaking News – FBI Email Breach
2:45 Cisco Firewall RCE Exploitation
5:03 Messaging App Phishing Campaigns

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

]]> Fri, 27 Mar 2026 14:04:00 -0700 Wordfence Wordfence 395 This week in Wordfence Security News (Week of Mar 23, 2026): 

  • Same-day exploitation of a critical RCE vulnerability in the Kali Forms plugin, attackers can achieve full admin takeover with a single request
  • Ongoing mass exploitation of the s2Member plugin targeting password reset functionality
  • Breaking News: Iran-linked hackers claim breach of FBI Director Kash Patel’s personal email
  • A critical Cisco firewall management vulnerability exploited as a zero-day by ransomware actors
  • FBI and CISA warn of phishing campaigns targeting messaging app accounts

Timestamps:

0:00 Introduction
0:25 Kali Forms RCE Vulnerability
1:34 s2Member Mass Exploitation
2:20 Breaking News – FBI Email Breach
2:45 Cisco Firewall RCE Exploitation
5:03 Messaging App Phishing Campaigns

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

]]> Wordfence, WordPress, WordPress Security, Cybersecurity No 30,000 Sites at Risk, Cisco Zero-Day & Stryker Attack | Wordfence Security News | Week of Mar 9, 2026 1 1 30,000 Sites at Risk, Cisco Zero-Day & Stryker Attack | Wordfence Security News | Week of Mar 9, 2026 full 08e87077-14c9-4622-b894-f31d76add52e https://share.transistor.fm/s/60882fd7 This week in Wordfence Security News (Week of Mar 9, 2026): 

  • A critical auth bypass in Tutor LMS Pro exposes 30,000+ WordPress sites — attackers can hijack admin accounts via a Google sign-in flaw
  • An unauthenticated SQL injection in Ally (400K+ sites)
  • Microsoft Patch Tuesday with ~80 fixes including AI-related exploits
  • A max-severity Cisco SD-WAN zero-day exploited since 2023
  • Iran-linked group Handala's claimed attack on medical device maker Stryker.

Timestamps:

0:00 Introduction
0:22 Tutor LMS Pro Authentication Bypass
1:31 Ally WordPress Plugin SQL Injection
1:50 Microsoft Patch Tuesday
2:46 Cisco SD-WAN Zero-Day
4:26 Handala Attack on Stryker
5:03 Iranian Drone Strikes on AWS Data Centers

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

]]> This week in Wordfence Security News (Week of Mar 9, 2026): 

  • A critical auth bypass in Tutor LMS Pro exposes 30,000+ WordPress sites — attackers can hijack admin accounts via a Google sign-in flaw
  • An unauthenticated SQL injection in Ally (400K+ sites)
  • Microsoft Patch Tuesday with ~80 fixes including AI-related exploits
  • A max-severity Cisco SD-WAN zero-day exploited since 2023
  • Iran-linked group Handala's claimed attack on medical device maker Stryker.

Timestamps:

0:00 Introduction
0:22 Tutor LMS Pro Authentication Bypass
1:31 Ally WordPress Plugin SQL Injection
1:50 Microsoft Patch Tuesday
2:46 Cisco SD-WAN Zero-Day
4:26 Handala Attack on Stryker
5:03 Iranian Drone Strikes on AWS Data Centers

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

]]> Fri, 13 Mar 2026 14:00:00 -0700 Wordfence Wordfence 343 This week in Wordfence Security News (Week of Mar 9, 2026): 

  • A critical auth bypass in Tutor LMS Pro exposes 30,000+ WordPress sites — attackers can hijack admin accounts via a Google sign-in flaw
  • An unauthenticated SQL injection in Ally (400K+ sites)
  • Microsoft Patch Tuesday with ~80 fixes including AI-related exploits
  • A max-severity Cisco SD-WAN zero-day exploited since 2023
  • Iran-linked group Handala's claimed attack on medical device maker Stryker.

Timestamps:

0:00 Introduction
0:22 Tutor LMS Pro Authentication Bypass
1:31 Ally WordPress Plugin SQL Injection
1:50 Microsoft Patch Tuesday
2:46 Cisco SD-WAN Zero-Day
4:26 Handala Attack on Stryker
5:03 Iranian Drone Strikes on AWS Data Centers

Story Links:

Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.  

]]> Wordfence, WordPress News, WordPress Security News, WordPress, WordPress Security, Cybersecurity, Cybersecurity News No