Your WordPress Backup Could Be Waiting to Betray You
A poisoned trackback can hide inside a WordPress backup until an administrator restores it, turning routine recovery into remote code execution.
Security
Vulnerabilities, defensive security, architecture and operational security.
They Stole the Keys to Brazil’s Payment Rails, Then Sent Hundreds of Transfers
BREEZE COMET stole the credentials and certificates behind trusted Brazilian payment workflows, then executed hundreds of fraudulent transactions within 24 to 48 hours.
ShinyHunters Talked Their Way Into a Major Banking Provider
Jack Henry says ShinyHunters used vishing to enter a non-production environment, exposing PII associated with fewer than ten clients.
A Rails Image Upload Could Hand Back Your Secrets as Pixels
Attackers are exploiting a Rails Active Storage flaw that can render server secrets as pixels and expose the keys needed for deeper compromise.
Your Password Was Fine. The Stolen Claude Session Still Drained the Account
Infostealers are stealing active Claude sessions, bypassing the need to defeat passwords or multi-factor authentication.
The Security Product Became the Privilege-Escalation Primitive
HardBreacher turns a trusted Kaspersky endpoint-security component into a privilege-escalation primitive. Kaspersky says the issue is fixed.
Someone Reprogrammed the Router Into a Listening Post
Fire Ant turned a Cisco IOS XR router, TACACS systems and Linux management hosts into a covert collection and access platform.
Berlin Refused Rhysida’s Ransom and the Leaks Kept Coming
Berlin says Rhysida released a further stolen-data package containing access credentials, forcing additional safeguards and possible service restrictions.
Six AshAI Flaws Turned Prompts Into a Path to Server Takeover
AshAI disclosed six vulnerabilities, including a CVSS 10 flaw that compiled attacker-controlled prompt content as Elixir before any model request.
An Estimated $75 Million Was Exposed, Then Cronos Pulled the Emergency Brake
Cronos halted its entire network after an exploit in Tectonic. The incident turns a DeFi collateral failure into a test of chain-wide emergency governance.