Tag: web application security
51 articles
NGINX Disrupts Multiple Flaws, Including Possible RCE and TLS Session Forgery
NGINX just dropped a critical update to squash five vulnerabilities, including a long-standing flaw dating back to May 2005 that could lead to code execution or crashes in certain configurations. The patches fix memory bugs, a TLS session-ticket weakness, and an HTTP/3 parser issue that could put your system at risk.
Drupal Fixes Core RCE Flaw with No-Login Path via Contributed Modules
A critical remote code execution flaw in Drupal's core Field UI module, tracked as CVE-2026-108097, has been patched, but the fix only helps sites that don't rely on contributed modules or custom code to stay safe. Over 151,000 Drupal sites are still vulnerable, highlighting the urgent need for an upgrade.
Hackers Exploit WordPress Plugins to Install Backdoors
Hackers are exploiting WordPress plugins to secretly create hidden admin accounts, allowing them to control your site without you even knowing. This sneaky tactic uses vulnerabilities like stored cross-site scripting (XSS) to install backdoors and gain full control.
Exploits Target Rejetto HFS Flaw for Admin Access
A critical flaw in Rejetto HFS, tracked as CVE-2026-61500, allows hackers to gain admin access by exploiting a weak pseudo-random number generator that generates session-cookie signing keys. This vulnerability, with a CVSS score of 9.3, puts users at risk of session forgery attacks.
WordPress Backdoor Persists Through Self-Healing Mechanisms
Meet the sneaky WordPress backdoor that refuses to be erased, thanks to its cunning self-healing mechanisms that spread its payload across eight files, the database, and shared memory. This clever malware can rebuild itself from any surviving copy, making it a formidable foe for security experts.
Elementor WordPress Plugin Exploited to Create Admin Accounts
A critical vulnerability in the popular Elementor WordPress Plugin has put up to 2 million sites at risk of admin account takeovers, with a single click on a malicious link potentially allowing hackers to gain control. This alarming exploit highlights the importance of updating to secure versions and exercising caution when clicking on links.
WordPress Exploits CVE-2026-87902 Flaw Within Hours of Disclosure
Within hours of being disclosed, WordPress was exploited through a critical vulnerability, CVE-2026-87902, that could allow hackers to remotely execute code on vulnerable sites. This flaw, with a near-perfect CVSS score of 9.2, lets unauthenticated attackers inject malicious code by tricking WordPress into including a rogue PHP file.
Next.js Flaw Exposes Servers to Code Execution via ImageResponse
A vulnerability in Next.js's ImageResponse feature, powered by the Satori library, allows attackers to inject malicious code by passing tainted values into image generation, putting servers at risk of code execution. This flaw can be exploited when attacker-controlled values are inserted into SVG content, attributes, or styles during image creation.
WordPress Patches Flaw That Enables Code Execution on Vulnerable Servers
WordPress has patched a critical vulnerability (CVE-2026-87902) that could allow hackers to execute malicious code on susceptible servers, giving attackers an easy way to take control. This flaw, rated 9.2 on the CVSS scale, can be exploited without an account or user interaction.
WordPress Flaw Exposes Sites to Code Execution via Comment
A cleverly crafted comment can turn into a powerful attack tool, allowing hackers to execute code on vulnerable WordPress sites - and it's all because moderation isn't a foolproof security measure. This surprising vulnerability, dubbed Comment2Shell, highlights a gap in WordPress's defenses that can be exploited with just a simple comment.
WordPress Flaw Exposes Servers to Remote Code Execution
A newly discovered WordPress vulnerability, dubbed Click2Shell, can be exploited to execute remote code on servers, and security researchers have already published technical details and a proof-of-concept. This critical flaw was patched in WordPress 7.1.1, but earlier versions remain vulnerable.
WordPress Patches Click2Shell Flaw That Forces Theme Installs
A simple click on a crafted link by a logged-in administrator could allow an attacker to silently install a malicious theme and execute code on your server, thanks to a high-impact vulnerability in WordPress dubbed Click2Shell. This security flaw exploits a discrepancy in how WordPress and the WordPress.org directory interpret web links.
WooCommerce Plugin Flaw Exploited to Upload PHP Webshells on WordPress Sites
Hackers have been actively exploiting a critical flaw in the WooCommerce Wholesale Lead Capture plugin to upload malicious PHP webshells to WordPress sites, despite a patch being available since February. Over 100,000 exploitation attempts were blocked by Wordfence's firewall, with multiple waves of attacks occurring over several months.
WordPress Plugin Flaw Exploited to Plant PHP Web Shells
A critical flaw in the popular WooCommerce Wholesale Lead Capture plugin has left over 6,000 active installs vulnerable to attacks, with over 100,000 exploit attempts blocked since June 2026. This urgent security issue allows hackers to upload malicious files, putting websites at risk.
Magento Zero-Day Exploited to Install Linux Backdoor
A newly discovered zero-day vulnerability, dubbed "StyleSmuggler," is being exploited in the wild to install a stealthy Linux backdoor on over 160,000 Magento and Adobe Commerce sites, including 14,000 of the top 1 million sites. This alarming attack has already hit a target running the latest security updates, leaving many sites vulnerable.
WordPress Sites Targeted in Mass Exploits of Plugin Flaws
Hackers have launched over 440,000 exploit attempts on WordPress sites, targeting critical flaws in popular plugins Super Forms and Elementor Pro, with attackers seeking to upload malicious files and execute remote code. Two high-severity vulnerabilities, CVE-2026-14894 and CVE-2026-32475, were behind the attacks, and have since been patched in the latest plugin updates.
Edge Security Exposes Hidden Risks in Legitimate Traffic
Despite having a robust arsenal of edge controls, security teams are still flying blind to hidden risks lurking in legitimate traffic, leaving them vulnerable to potential threats. The issue lies in the lack of context around underlying infrastructure, causing standard defenses to miss high-risk sessions.
Avada WordPress Theme Flaw Enables Zero-Click Remote Code Execution
A critical vulnerability in the Avada WordPress theme, scored 9.8 out of 10, can be exploited through a zero-click remote code execution attack, allowing hackers to run malicious PHP code on affected sites without needing login credentials. This flaw enables attackers to take full control of a site, planting malware, stealing data, or creating rogue admin accounts.
GitLab Flaw Exploited in Wild Days After Disclosure
In a chilling demonstration of the new reality in vulnerability exploitation, attackers began exploiting a newly disclosed GitLab flaw within minutes of its public disclosure, leaving little time for patching. This rapid reproduction and exploitation is a stark reminder that waiting for the next patch cycle may no longer be a viable defense strategy.
Elementor Pro Flaw Enables Unauthenticated Code Execution
A critical vulnerability in Elementor Pro, rated CVSS 9.0, allows hackers to execute malicious code remotely - and it's surprisingly easy to exploit, thanks to a logic flaw in the plugin's Forms module. This loophole lets attackers bypass security checks and write PHP files to a public uploads directory.
CISA Mandates Swift Fix for Exploited Ray RCE Flaw
A critical bug in the Ray framework, scoring 9.4 under CVSS v4, can be exploited for remote code execution with a simple visit to a malicious web page or hostile ad in Firefox or Safari. This vulnerability can be triggered when an attacker crafts requests that appear browser-originated, allowing for a potentially disastrous security breach.
CSS Attacks Break Webmail Defenses to Steal Passwords and Tokens
Researchers have discovered alarming proof-of-concept techniques that allow attackers to exploit styled HTML in emails, breaking through webmail defenses to steal passwords, tokens, and even hijack trusted actions. This vulnerability affects major email services including Outlook, Gmail, and Yahoo Mail, and public proof-of-concept code is readily available.
WordPress Fixes Pre-Auth XSS Flaw That Enables PHP Code Execution
WordPress has patched a high-severity flaw that could let attackers inject malicious code into your site - and it's crucial you update ASAP, as 41.2% of all websites are potentially vulnerable.
AI Research Exposes Novel HTTP Desync Techniques and Apache Zero-Day
Meet HTTP Terminator, an AI-powered research system that generated 30,000 candidate desync vectors and helped uncover novel HTTP desynchronization techniques, including an Apache Traffic Server zero-day. This groundbreaking tech scanned 30,000 websites, pushing the boundaries of vulnerability discovery.