Wordfence Security News

UpdraftCentral Key Compromise, Rank Math Malware & ConnectWise Breach | Wordfence Security News #21

This week in Wordfence Security News (Week of October 19, 2026):

• Exposed UpdraftCentral connection keys let attackers install malicious plugins on cloud-connected WordPress sites; UpdraftPlus 1.26.12 and 2.26.12 revoke them.
• Some Rank Math SEO Pro 3.0.123 downloads from October 15-16 contained malware; treat sites that activated one as compromised, as 3.0.124 alone won't clean it.
• Compromised ConnectWise cloud backup credential showed sign-in activity in almost 1,000 Microsoft Entra environments, with more than 300 successful sign-ins.
• Attackers chained zero-day flaws in Ivanti Connect Secure VPN for full control, stealing Active Directory data and evading the Integrity Checker.
• BlockStrap, a maximum severity 10 flaw in Magento and Adobe Commerce, lets attackers run code on store servers without logging in; patch released October 13.

Timestamps:

0:00 Introduction

0:35 UpdraftCentral connection keys used to install malicious plugins

2:58 Malware found in some Rank Math SEO PRO 3.0.123 downloads (CVE-2026-111862)

4:48 ConnectWise Cloud Backup app credential abused in Microsoft 365

6:49 Ivanti Connect Secure zero-day chain (CVE-2026-104935)

8:33 BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)

Story Links:

• UpdraftCentral connection keys used to install malicious plugins
• Malware found in some Rank Math SEO PRO 3.0.123 downloads (CVE-2026-111862)
• ConnectWise Cloud Backup app credential abused in Microsoft 365
• Ivanti Connect Secure zero-day chain (CVE-2026-104935)
• BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

Wordfence Argus Finds Ghostscript RCE, Jira Leak & Crypto-Mining Hacks | Wordfence Security News #20

This week in Wordfence Security News (Week of October 12, 2026):

• Wordfence Argus found a critical Ghostscript flaw that lets a crafted PDF run code on servers generating WordPress PDF previews, fixed in Ghostscript 10.08.0.
• Critical Atlassian file read flaw in eight self-managed products drew 386 attack attempts from 60 IP addresses after watchTowr published exploit code.
• Attackers chained two AhsayCBS backup flaws to gain system-level control, leave hidden access, and install a cryptominer disguised as Microsoft Edge.
• Ledger found an LTE implant in tampered wallets sold by CryptoBilis that captured 24-word recovery phrases during setup and sent them over cellular.
• Attackers forced refrigeration systems into defrost at more than 500 French stores; CERT-FR now lists Danfoss, Copeland, and Dixell controllers.

Timestamps:

0:00 Introduction

0:42 Wordfence Argus Finds Critical Ghostscript Flaw

3:17 Atlassian File Read Flaw in Eight Self-Managed Products

4:56 AhsayCBS Backup Flaws Exploited

6:49 Ledger Finds LTE Implant in Tampered Wallets

8:26 Refrigeration Defrost Attack at 500+ French Stores

Story Links:

• Wordfence Argus finds critical Ghostscript flaw behind WordPress PDF previews
• Atlassian file read flaw in eight self-managed products exploited after public PoC (CVE-2026-21589)
• AhsayCBS backup flaws exploited to drop webshells and a cryptominer
• Ledger finds LTE implant in tampered wallets sold by CryptoBilis
• Attackers force refrigeration defrost at 500+ French stores; CERT-FR widens to Copeland and Dixell

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

WordPress Core RCE, PeopleSoft WAF Bypass & Citrix NetScaler Zero-Days | Wordfence Security News #19

This week in Wordfence Security News (Week of September 28, 2026):

• Unauthenticated WordPress core file inclusion flaw drew more than 4.27 million requests matching the Wordfence firewall rule.
• ShinyHunters resumed mass exploitation of a critical Oracle PeopleSoft flaw, bypassing firewall rules by encoding one character.
• Two critical Citrix NetScaler flaws were exploited before Citrix disclosed them on September 27, with a September 30 federal deadline.
• Two GitHub Actions compromised in May became reachable again September 16-25 with malicious release tags intact.
• Apple patched a CoreGraphics flaw that may have been used in an extremely sophisticated attack on targeted individuals.

Timestamps:

0:00 Introduction

0:40 WordPress core file inclusion: 4.27 million requests captured

3:13 ShinyHunters bypasses WAF rules targeting Oracle PeopleSoft

5:15 Citrix NetScaler flaws exploited - federal deadline September 30

6:37 Compromised GitHub Actions switched back on for over a week

8:04 Apple patches CoreGraphics flaw possibly used in targeted attack

Story Links:

• WordPress core file inclusion: 4.27 million requests captured
• Wordfence PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
• ShinyHunters bypasses WAF rules targeting Oracle PeopleSoft
• Citrix NetScaler flaws exploited - federal deadline September 30
• Compromised GitHub Actions switched back on for over a week
• Apple patches CoreGraphics flaw possibly used in targeted attack

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

libheif RCE, All-in-One WP Migration SQLi & Exploited Cisco Flaws | Wordfence Security News #18

This week in Wordfence Security News (Week of September 28, 2026):

• Wordfence Argus found a critical CVSS 9.8 heap overflow in libheif, the system library that decodes iPhone HEIC photos on Linux servers.
• The official WordPress Docker image, Debian 13, Ubuntu 26.04 and Fedora 44 were vulnerable out of the box; the fix landed in libheif 1.23.3.
• SQL injection in All-in-One WP Migration and Backup (5 million installs) through 7.109 drew probing against 881 sites; patched in 7.110.
• Cisco Secure Email Gateway AsyncOS SQL injection is on CISA's exploited list, with no workaround and a federal deadline that passed September 17.
• Sandworm and a Qilin ransomware crew exploited two Cisco Secure Firewall Management Center flaws, including a CVSS 10 auth bypass.
• Twitch Enhanced Viewer, with roughly 30,000 Chrome users, forwarded live OAuth session tokens to a third-party bot service; fixed in 85.8.7.

Timestamps:

0:00 Introduction

0:39 Wordfence Argus finds critical libheif flaw (iPhone photo library)

3:18 All-in-One WP Migration and Backup archive restore SQL injection

4:55 Cisco Secure Email Gateway SQL injection

6:34 Cisco Secure Firewall Management Center flaws under active exploitation

8:07 Twitch extension forwarded viewer session tokens to a Russian bot service

Story Links:

• Wordfence Argus finds critical libheif flaw (iPhone photo library)
• All-in-One WP Migration and Backup archive restore SQL injection
• Cisco Secure Email Gateway SQL injection
• Cisco Secure Firewall Management Center flaws under active exploitation
• Twitch extension forwarded viewer session tokens to a Russian bot service

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• (00:00) - Introduction

The Events Calendar RCE, N-central Takeover & Magento Zero-Day | Wordfence Security News #17

This week in Wordfence Security News (Week of September 14, 2026):

• The Events Calendar patched two critical RCE chains on September 10; Wordfence logged the first exploit attempt 2.2 hours after disclosure.
• Wordfence's firewall matched 3,285 requests across 619 sites in four and a half days, 2,103 consistent with exploitation.
• N-able fixed a maximum severity pre-auth RCE in N-central; CISA's federal remediation deadline of September 11 has passed.
• StyleSmuggler hit Adobe Commerce and Magento Open Source on September 4, three days before Adobe's CVSS 10.0 hotfix.
• GitLab patched a critical unauthenticated path traversal on September 10; attackers probed it within 24 hours of disclosure.
• Chrome's September 8 update shipped 230 security fixes, including a medium-rated V8 out-of-bounds write exploited in the wild.

Timestamps:

0:00 Introduction

0:35 The Events Calendar unauthenticated object injection to RCE

2:42 N-able N-central pre-authentication RCE

3:49 StyleSmuggler Adobe Commerce and Magento zero-day

4:57 GitLab repository Commits API path traversal

5:38 Chrome/Chromium V8 out-of-bounds write

Story Links:

• The Events Calendar unauthenticated object injection to RCE
• Wordfence Argus identifies two critical unauthenticated RCE chains in The Events Calendar (Wordfence blog)
• N-able N-central pre-authentication RCE
• StyleSmuggler Adobe Commerce and Magento zero-day
• GitLab repository Commits API path traversal
• Chrome/Chromium V8 out-of-bounds write

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• (00:00) - Introduction

WP2Shell RCE, SonicWall Zero-Days & ServiceNow Exploit | Wordfence Security News #16

This week in Wordfence Security News (Week of July 20, 2026):

• WP2Shell chains two WordPress core bugs into unauthenticated RCE on default installs of 6.9 and 7.0; CISA added both flaws to its KEV catalog on July 21.
• Attackers had root on SonicWall SMA 1000 VPN appliances for about three weeks before the July 14 advisory, capturing LDAP credentials off the wire.
• A separate Palo Alto GlobalProtect authentication bypass was the way in for June intrusions that ended in Qilin ransomware.
• A pre-auth ServiceNow AI Platform sandbox escape was exploited three days after its write-up went public; self-hosted and partner-managed instances are at risk.
• CISA added a 2008 Cisco IOS flaw to its KEV catalog as allied agencies warned of an FSB unit copying router configurations over weak SNMP.
• OpenAI says its own models escaped an evaluation sandbox and hacked Hugging Face to grab benchmark answers.
• The Jscrambler and AsyncAPI npm compromises stole developer secrets in ways that disabling install scripts would not stop.

Timestamps:

0:00 Introduction

0:48 WP2Shell WordPress core unauthenticated RCE

5:38 SonicWall SMA 1000 VPN zero-days

7:50 ServiceNow AI Platform pre-auth RCE

9:22 2008 Cisco IOS flaw added to CISA KEV

11:30 OpenAI models hack Hugging Face

14:16 AsyncAPI and Jscrambler npm compromises

Story Links:

• PSA: WordPress Core patched unauthenticated RCE vulnerability chain (Wordfence)
• wp2shell aftermath: the first critical unauthenticated WordPress core RCE in nearly a decade (Wordfence)
• WP2Shell exploit technical analysis and real attack data (Wordfence)
• WP2Shell: pre-authentication RCE in WordPress core
• SonicWall SMA 1000 VPN zero-day exploitation
• Palo Alto GlobalProtect bypass leads to Qilin ransomware
• ServiceNow AI Platform pre-auth RCE (CVE-2026-6875)
• CISA adds 2008 Cisco IOS flaw to KEV
• Joint advisory on FSB targeting of network devices
• OpenAI on the Hugging Face model evaluation incident
• AsyncAPI npm supply chain compromise (Microsoft)
• Jscrambler supply chain attack (Socket)

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• (00:00) - Introduction

WordPress Backdoors, NetScaler Bleed & AI Ransomware | Wordfence Security News #15

This week in Wordfence Security News (Week of July 13, 2026):

• Exposed hacker server reveals mass WordPress backdooring op chaining 27 known flaws; over 25,000 sites with confirmed or validated compromise
• Critical Adobe ColdFusion path traversal patched June 30 saw exploitation attempts within hours of technical details going public
• SharePoint Server on-prem RCE Microsoft rated exploitation less likely added to CISA's exploited catalog July 1
• New NetScaler pre-auth memory overread leaks process memory on SAML IdP configs, echoing CitrixBleed
• RoguePlanet, a fourth Defender flaw from the BlueHammer researcher, escalates a local attacker to system
• Sysdig assesses the first documented agentic ransomware case: an AI agent encrypted 1,342 config items via a Langflow flaw
• Symlink trick in a booby-trapped GitHub repo fools six AI coding assistants into writing an attacker SSH key

Timestamps:

0:00 Introduction

0:52 WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring Operation

4:39 Adobe ColdFusion Flaw Exploited After Details Go Public

6:08 SharePoint Flaw Microsoft Called Unlikely Is Now on CISA's List

7:21 New NetScaler Flaw Echoes CitrixBleed

8:19 Microsoft Patches RoguePlanet, Fourth Defender Flaw from Same Researcher

9:14 Researchers Describe Possible First AI-Run Ransomware Attack

11:27 Symlink Trick Fools Six AI Coding Assistants

Story Links:

• WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring Operation
• Adobe ColdFusion Flaw Exploited After Details Go Public
• SharePoint Flaw Microsoft Called Unlikely Is Now on CISA's List
• New NetScaler Flaw Echoes CitrixBleed
• Microsoft Patches RoguePlanet, Fourth Defender Flaw from Same Researcher
• Researchers Describe Possible First AI-Run Ransomware Attack
• Symlink Trick Fools Six AI Coding Assistants

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

• (00:00) - Introduction

OMGF Pro Exploited, Oracle Payments Attack & AI Repo Backdoor | Wordfence Security News #14

This week in Wordfence Security News:

• OMGF Pro unauthenticated file upload exploited during disclosure: 60,000+ blocked attempts across nearly 8,000 sites, fixed in 5.2.7
• Oracle E-Business Suite Payments auth bypass exploited in the wild despite a May patch; Shadowserver tracked around 950 exposed EBS instances
• PTC Windchill and FlexPLM unauthenticated RCE added to CISA KEV on June 25 after attackers deployed JSP web shells
• BlueHammer, the deliberately leaked Microsoft Defender flaw, now flagged by CISA as used in ransomware attacks
• SimpleHelp OIDC signature flaw grants fake technician accounts, dropping the Taskweaver loader and Djinn info stealer
• Mozilla 0DIN demo shows a clean GitHub repo tricking Claude Code into fetching a DNS TXT payload and opening a shell

Timestamps:

0:00 Introduction

0:48 Active Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload

3:42 Oracle E-Business Suite Payments Exploited in the Wild

5:21 PTC Windchill / FlexPLM RCE Added to CISA KEV

6:21 BlueHammer Microsoft Defender Flaw Used in Ransomware Attacks

6:57 SimpleHelp Auth Bypass Exploited to Deploy Djinn Stealer

8:46 Clean GitHub Repo Tricks AI Coding Agents Into Running Malware

Story Links:

• Active Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload During Responsible Disclosure Window.
• Oracle E-Business Suite Payments Exploited in the Wild
• PTC Windchill / FlexPLM RCE Added to CISA KEV
• BlueHammer Microsoft Defender Vulnerability Exploited in Ransomware Attacks
• SimpleHelp Auth Bypass Exploited to Deploy Djinn Stealer
• Clean GitHub Repo Tricks AI Coding Agents Into Running Malware / Mozilla 0DIN Claude Code Demo

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

Uncanny Automator Backdoor, Splunk Exploited & AI Key Theft

This week in Wordfence Security News (Week of June 23, 2026):

• Uncanny Automator Pro Backdoored Through Update Server
• Splunk Enterprise Flaw Exploited in the Wild
• Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls
• LiteLLM Flaw Puts AI Gateway Keys at Risk
• Malicious JetBrains Plugins Stole AI API Keys

Timestamps:

00:00 Intro
00:37 Uncanny Automator Pro Backdoored Through Update Server
06:08 Splunk Enterprise Flaw Exploited in the Wild
08:54 Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls
11:49 LiteLLM Flaw Puts AI Gateway Keys at Risk
14:39 Malicious JetBrains Plugins Stole AI API Keys

Story Links:

1. Uncanny Automator Pro Backdoored Through Update Server

2. Splunk Enterprise Flaw Exploited in the Wild

3. Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls

4. LiteLLM Flaw Puts AI Gateway Keys at Risk

5. Malicious JetBrains Plugins Stole AI API Keys

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

WordPress Supply Chain Attacks, Ivanti Root Flaw, and phpBB Account Takeovers

This week in Wordfence Security News (Week of June 15, 2026):

• ShapedPlugin's paid pro plugins were backdoored via the vendor's update system, stealing passwords and 2FA secrets
• OptinMonster, TrustPulse, and PushEngage served a tampered CDN script that targeted logged-in admins
• Oracle PeopleSoft zero-day exploited by ShinyHunters hit 300+ systems, 68% in higher education
• Ivanti Sentry CVSS 10 OS command injection flaw gives attackers root, added to CISA KEV
• Langflow AI app builder path traversal flaw now actively exploited against unpatched instances
• phpBB authentication bypass lets attackers hijack any account with just a username and one request

Timestamps:

0:00 Introduction

0:42 ShapedPlugin Multiple Plugins Supply Chain Compromised

5:11 OptinMonster / TrustPulse / PushEngage Tampered Script Served via Compromised CDN

7:48 Oracle PeopleSoft Zero-Day Exploited by ShinyHunters

10:17 Ivanti Sentry CVSS 10 RCE Added to KEV

11:53 Langflow RCE Actively Exploited Against Exposed AI App Builders

13:46 phpBB Authentication Bypass Lets Attackers Hijack Accounts

Story Links:

• ShapedPlugin Multiple Plugins Supply Chain Compromised
• OptinMonster / TrustPulse / PushEngage Tampered Script Served via Compromised CDN
• Oracle PeopleSoft Zero-Day Exploited by ShinyHunters
• Ivanti Sentry CVSS 10 RCE Added to KEV
• Langflow RCE Actively Exploited Against Exposed AI App Builders
• phpBB Authentication Bypass Lets Attackers Hijack Accounts

Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.