Latest security news

Researched & explained in plain language

What website owners should know right now

FormGent Plugin: Critical Flaw Allows Site Takeover (CVE-2026-3141)

A critical vulnerability in the WordPress plugin FormGent lets unauthenticated attackers delete wp-config.php – patch now!

CVE-2026-12965: Critical SQL Injection in Super Store Finder for WordPress

The Super Store Finder plugin (up to 7.8) allows unauthenticated SQL injection. Attackers read database contents without login – still unpatched.

Data Breach in Liechtenstein: 31,000 Firms and Foundations Hit

Attackers stole owner data of 31,000 legal entities from the VwbP register. Register offline, crisis team convening – no perpetrator known.

GDPR Fines July 2026: €1.7M for Wind Tre After Social Engineering

Attackers posed as support technicians and stole 365,000 customer records. Wind Tre and four more cases at a glance.

NGINX CVE-2026-42533: Critical Buffer Overflow Enables RCE

A flaw in NGINX present since 2011 enables unauthenticated remote code execution. Who is affected and how to patch it now.

CVE-2026-8457: Auth Bypass in WooCommerce Social Login via Forged Apple JWT

Missing JWT signature check in Apple login lets attackers log in as any user, including admins. CVSS 9.8. Update to 2.8.8 now.

WPManageNinja Hacked: Fluent Forms Pro and Ninja Tables Pro Tampered

Via an old update server, WPManageNinja distributed tampered plugin versions for five hours. Here's how to check your website.

User Access Manager: CVE-2026-18352 Exposes wp-config.php

Critical path traversal flaw in the User Access Manager plugin (up to 2.3.15) lets attackers read sensitive files. Update to 2.3.16 now.

Hotel Wi-Fi as a Trap: APT28 Steals Microsoft 365 Logins via DNS Poisoning

APT28 tampers with hotel captive portals to redirect guests to fake M365 pages—MFA is bypassed via OAuth device flow.

Adform Attack: Manipulated Tracking Script Steals Crypto Wallets

A compromised Adform script replaced crypto addresses of website visitors for over a week. Here's how the supply chain attack worked.

CVE-2026-1360: PHP Object Injection in BuddyPress Leads to RCE

A deserialization flaw in BuddyPress lets authenticated attackers inject PHP objects, potentially leading to Remote Code Execution.

Critical Flaws in Joomla Extensions SP Page Builder Actively Exploited

Two critical flaws (CVSS 9.8) in SP Page Builder and Page Builder CK enable remote code execution. Patch immediately now!