Latest security news

Researched & explained in plain language

What website owners should know right now

WordPress RCE Actively Exploited: 11M Attacks on WP2Shell Flaw

Critical WordPress Core vulnerability chain enables RCE without login. CISA warns, Wordfence blocks millions of exploits – patch now!

Backdoor in WordPress Plugin ARVE: CVE-2026-18072 critical

Version 10.8.7 of the video plugin contains a backdoor: attackers log in as admin via GET request. 20,000 sites affected.

Compromised @joyfill npm Packages Spread RAT via Blockchain C2

Malicious @joyfill npm packages activate a RAT on import that steals credentials and is controlled via blockchain C2. North Korea suspected.

Critical VMware Flaws: Auth Bypass, RCE and VM Escape in vCenter & ESXi

Broadcom patches three critical flaws in vCenter and ESXi. Auth bypass, RCE and VM escape threaten entire virtualization environments. Patch now!

CVE-2026-42533: Critical NGINX Flaw with PoC – RCE via TLS

PoC for critical NGINX vulnerability (CVSS 9.2) released: attackers can achieve RCE via TLS ClientHello. Around 30% of all web servers are affected.

Wpify Woo: Privilege Escalation Lets Shop Managers Become Admins

CVE-2026-12736: A flaw in Wpify Woo up to 5.4.16 lets shop managers overwrite arbitrary WordPress options and gain admin privileges.

SharePoint Flaw CVE-2026-50522 Actively Exploited: Machine Keys Stolen

A critical RCE flaw in SharePoint is being actively exploited. Attackers steal Machine Keys—patching alone is not enough.

Supply Chain Attack: GitHub Actions Weaponized Against cPanel Servers

Compromised Packagist packages abuse GitHub runners to attack cPanel/WHM servers via CVE-2026-41940 and steal secrets.

uniVersa: OpenAI Crawler Grabs Customer Data via Open Server

An OpenAI crawler pulled names, addresses and some IBANs at uniVersa. The cause: an IT change that made a server publicly accessible.

Stadler Rail Refuses 10M Franc Ransom After Everest Attack

The Everest group demanded 10M francs from Stadler Rail. The attack via a shared supplier platform shows the danger of supply chain attacks.

wp2shell: Critical WordPress RCE Without Login Actively Exploited

Two chained WordPress flaws (CVE-2026-63030 & CVE-2026-60137) enable anonymous RCE. 60% of organizations affected – patch now.

WPForms Pro: Unauth. Datei-Upload führt zu RCE (CVE-2026-10818)

Kritische Lücke in WPForms Pro bis 1.10.1.1: Angreifer laden PHP-Dateien hoch und erreichen RCE. Jetzt auf Version 2.0.0 aktualisieren.