A Comment Could Take Over Your WordPress Site Before You Approved It
Holding comments for approval sounds like a sensible defence. These Events Calendar takeover chains can reach the vulnerable code while the comment is still pending.
Security
Vulnerabilities, defensive security, architecture and operational security.
Your API Gateway Can Accept an Admin Token Nobody Should Trust
A forged token hit the wrong product in a honeypot. Replayed against vulnerable WSO2 software, it worked. An old patch now deserves a fresh look at the gateway protecting your APIs.
They Could Not Open the File at Work, So the Spies Asked Them to Try at Home
A corporate security block did not always end the conversation. A joint advisory describes attackers asking targets to open disguised malware on personal devices instead, where the exposure can extend beyond work data.
This Shop Plug-in Let Attackers Decide Which Files Were Safe to Upload
The upload handler checked a permitted-file list supplied by the person uploading the file. Wordfence says attackers have been exploiting that mistake for months, despite a fix being available.
The WordPress Update Was Backdoored, Then Its Replacement Was Compromised Too
Installing the replacement was not enough: the developer says a second intrusion compromised it too. Site owners need a recovery decision, not another green update badge.
Your Pixel’s September Update Fixes a Modem Flaw Google Says May Be Under Attack
Google's September bulletin flags possible targeted exploitation of a Pixel modem flaw, now also listed in CISA's exploited-vulnerability catalogue. The useful check is the installed patch level.
Attackers Are Abusing the Backup Plugin Behind Your Hosting Control Panel
The backup integration behind a hosting control panel has an exploited Linux privilege-escalation flaw. An attacker needs a local foothold first, but that is not where the risk ends.
This Malware Makes Chrome Trust an Extension You Never Approved
The browser can load the malicious extension as though you approved it. Elastic's KREMLIN investigation shows why a familiar banking document can become an endpoint and session-security problem.
Attackers Are Bypassing Cisco ISE’s Login and a Clean Log May Not Mean You’re Safe
The platform deciding who may enter your network has an exploited login bypass. Patching Cisco ISE closes the flaw, but deciding whether a node can still be trusted takes a separate investigation.
Ace & Tate’s Copied Order Details Can Make the Next Scam Look Real
Ace & Tate has confirmed that customer contact, order and delivery details were copied from logistics partner CEVA. The fields can make delivery scams more convincing even though payment data and passwords were not involved.