Latest security news

Researched & explained in plain language

What website owners should know right now

Joomla JCE Editor: Critical RCE Flaw Without Login (CVE-2026-48907)

Attackers can upload PHP code to JCE servers without logging in. Update to version 2.9.99.9 now and check your systems.

Shopware CVE-2026-48014: Authorization Bypass in the Admin API

CVE-2026-48014 lets low-privileged API users change order states without ACL checks. Overview of affected versions and patches.

Supply Chain Attack on OptinMonster & Co.: 1.2M WordPress Sites Hit

Manipulated CDN scripts in OptinMonster, TrustPulse and PushEngage secretly created admin accounts – 1.2M websites at risk.

CVE-2026-15414: Privilege Escalation in Subscriptions for WooCommerce

Contributors become admins: via the _wps_plan_user_role meta field, attackers gain full administrator rights. Update urgently required.

Wind Tre: €1.72M GDPR Fine After Social Engineering Attack

Attackers posed as support technicians and stole data from 365,000 customers. The Garante penalizes lacking API protection.

CVE-2026-54768: WPGraphQL Allows User Enumeration Without Login

A deprecated GraphQL field in WPGraphQL exposes author accounts to unauthenticated attackers. Updating to version 2.15.1 closes the gap.

ASE Pro for WordPress: Critical Unauthenticated RCE Flaw (CVE-2026-16610)

CVSS 9.8: Unauthenticated attackers execute arbitrary PHP code via an unsanitized eval(). No patch available.

CVE-2026-15006: Bit Integrations Allows Unauthorized File Read

Critical flaw in WordPress plugin Bit Integrations up to v2.9.0: attackers read sensitive server files without login. No patch yet – act now.

Analog Devices: Cyberattack and Extortion Over 570,000 Records

Chipmaker Analog Devices reports data theft. Extortion group ExfilSquad claims 570,000 stolen records – details still unclear.

Vishing via Microsoft Teams: STAC4749 Spreads Chaos Ransomware

Attackers pose as IT support in Teams calls and encrypt corporate networks within hours using Chaos ransomware.

900,000 Euro GDPR Fine: Berlin Court Convicts Deutsche Wohnen

Unlawful archive system without deletion: Berlin Regional Court I imposes a 900,000 euro fine on Deutsche Wohnen SE. What companies must learn now.

CNIL Fines IQVIA EUR 5 Million Over Anonymization

IQVIA wrongly treated pseudonymized health data as anonymous. The CNIL deemed it re-identifiable and imposed a EUR 5 million fine.