Latest security news

Researched & explained in plain language

What website owners should know right now

iCloud Phishing Picks Attack by OS and Steals MFA Codes

A phishing campaign with fake iCloud alerts picks the attack path by OS and steals MFA codes in real time via Telegram AiTM.

Drupal Quick Tabs: CVE-2026-73477 Exposes Unpublished Content

Faulty access checks in Quick Tabs before 4.3.1 reveal unpublished nodes and blocks. Here's how to protect your Drupal site.

Drupal External Authentication: Access Bypass via DB Collations

CVE-2026-73476 allows a bypass in Drupal External Authentication before 2.0.13 under common MySQL/MariaDB collations. Upgrade strongly recommended.

SSRF in Drupal Entity Share Websub: CVE-2026-73474 Endangers Servers

The Drupal module Entity Share Websub before 1.1.2 allows SSRF attacks due to poor input validation. All configurations are affected.

Drupal Diff Module: CVE-2026-73478 Exposes Revision Data

The Drupal Diff module inadequately restricts access to revision comparisons of non-node entities. Which versions are affected and what to do.

CVE-2026-18789: Ezoic Plugin Exposes WordPress Database to Attackers

Unauthenticated attackers can export the WordPress database via the Ezoic plugin—including password hashes and reset tokens. Over 10,000 sites affected.

Epeken for WooCommerce: Orders Can Be Marked Paid Without Authorization

A flaw in the Epeken All Kurir plugin lets unauthenticated attackers mark other users' WooCommerce orders as confirmed or paid.

CVE-2026-18039: Essential Addons for Elementor Enables Admin Takeover

Unauthenticated attackers can gain admin rights during registration. Over two million installations affected—update to 6.7.2 now.

SQL Injection in Bit Form: CVE-2026-16810 Threatens Databases

A SQL injection in Bit Form up to version 3.2.0 allows attacks via the data[queryCondition] parameter. Over 10,000 installations affected.

Metabase Zero-Day Actively Exploited: Admin Access Without Login

A critical SQL injection in Metabase is being exploited as a zero-day. Attackers gain admin rights without login and read database credentials.

SonicWall SMA1000: Ransomware Groups Exploit Critical Flaws

CISA warns: ransomware gangs attack SonicWall SMA1000 via CVE-2026-15409/15410. Over 380 appliances exposed online – patches available since July.

SharePoint Flaw CVE-2026-55040: Attacks After PoC Release

CVE-2026-55040 bypasses SharePoint authentication and is under active attack. With CVE-2026-63520, remote code execution even looms.