Latest security news

Researched & explained in plain language

What website owners should know right now

Backdoor in WordPress Plugin: Admin Takeover via CVE-2026-18072

Version 10.8.7 of the video embedder plugin contains a backdoor. Attackers gain admin control—no patch available.

AI Copilot Content Generator: Critical Flaw Enables Admin Account (CVE-2026-14526)

Unauthenticated attackers can create an admin account in the WordPress plugin AI Copilot. CVSS 9.8 – apply the patch now!

BGH: GDPR Damages for Misdirected Applicant Data

The BGH grants non-material damages under Art. 82 GDPR when applicant data is accidentally sent to third parties. What this means for companies.

Kali365: Phishing-as-a-Service Bypasses Microsoft 365 MFA

The PhaaS platform Kali365 hijacks Microsoft 365 accounts via attacker-controlled device codes and defeats MFA - 80+ companies hit weekly.

macOS CVE-2026-65400: Critical Authentication Bypass in Screen Sharing

Attackers on the local network take over macOS without a password via Screen Sharing. Apple ships updates for Tahoe, Sequoia and Sonoma.

Adobe Commerce & Magento: 14 Flaws Patched, One Critical (CVSS 9.6)

Adobe's APSB26-73 fixes fourteen vulnerabilities in Commerce and Magento, including a critical flaw rated CVSS 9.6. Update now.

TeamCity CVE-2026-63077: Actively Exploited RCE, CISA Patch Deadline Aug 8

Critical RCE flaw (CVSS 9.8) in JetBrains TeamCity is actively exploited. Attackers gain full access to build pipelines and credentials.

cPanel CVE-2026-58048: SQL Injection Enables Database Root Access

A critical flaw in cPanel & WHM lets authenticated users run SQL commands as root. PoC is public - patch now to stay protected.

Exim CVE-2026-45185 'Dead.Letter': Critical RCE in GnuTLS Builds

Unauthenticated RCE in the BDAT parser of Exim 4.97-4.99.2 on Debian/Ubuntu. CVSS 9.8. Patch 4.99.3 available – act now.

WordPress 7.0.3: Pre-Auth XSS (CVE-2026-64638) Enables Code Execution

Security update fixes 12 flaws. Critical login XSS can escalate to remote code execution — PoC already publicly available.

WPMU DEV Dashboard ≤ 5.0.0: Auth Bypass Enables RCE, Actively Exploited

Critical flaw in WPMU DEV Dashboard allows unauthenticated plugin install and RCE. Wordfence blocked 3,419 attacks. Update to 5.0.1 required now.

Kadence WooCommerce Email Designer: Critical Privilege Escalation Without Login

Versions up to 1.5.19 let unauthenticated attackers gain admin rights. Update to 1.5.20 urgently advised—here's how to protect your shop.