Wordfence Security News

Wordfence
  • 5.0 (3)
  • Tech News
  • Updated Weekly

Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.

  1. Oct 16

    libheif RCE, All-in-One WP Migration SQLi & Exploited Cisco Flaws | Wordfence Security News #18

    libheif RCE, All-in-One WP Migration SQLi & Exploited Cisco Flaws | Wordfence Security News #18 This week in Wordfence Security News (Week of September 28, 2026): Wordfence Argus found a critical CVSS 9.8 heap overflow in libheif, the system library that decodes iPhone HEIC photos on Linux servers.The official WordPress Docker image, Debian 13, Ubuntu 26.04 and Fedora 44 were vulnerable out of the box; the fix landed in libheif 1.23.3.SQL injection in All-in-One WP Migration and Backup (5 million installs) through 7.109 drew probing against 881 sites; patched in 7.110.Cisco Secure Email Gateway AsyncOS SQL injection is on CISA's exploited list, with no workaround and a federal deadline that passed September 17.Sandworm and a Qilin ransomware crew exploited two Cisco Secure Firewall Management Center flaws, including a CVSS 10 auth bypass.Twitch Enhanced Viewer, with roughly 30,000 Chrome users, forwarded live OAuth session tokens to a third-party bot service; fixed in 85.8.7.Timestamps: 0:00 Introduction 0:39 Wordfence Argus finds critical libheif flaw (iPhone photo library) 3:18 All-in-One WP Migration and Backup archive restore SQL injection 4:55 Cisco Secure Email Gateway SQL injection 6:34 Cisco Secure Firewall Management Center flaws under active exploitation 8:07 Twitch extension forwarded viewer session tokens to a Russian bot service Story Links: Wordfence Argus finds critical libheif flaw (iPhone photo library)All-in-One WP Migration and Backup archive restore SQL injectionCisco Secure Email Gateway SQL injectionCisco Secure Firewall Management Center flaws under active exploitationTwitch extension forwarded viewer session tokens to a Russian bot service Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter. (00:00) - Introduction (00:39) - Wordfence Argus finds critical libheif flaw (iPhone photo library) (03:18) - All-in-One WP Migration and Backup archive restore SQL injection (04:55) - Cisco Secure Email Gateway SQL injection (06:30) - Cisco Secure Firewall Management Center flaws under active exploitation (08:07) - Twitch extension forwarded viewer session tokens to a Russian bot service

    libheif RCE, All-in-One WP Migration SQLi & Exploited Cisco Flaws | Wordfence Security News #18

  2. Oct 2

    The Events Calendar RCE, N-central Takeover & Magento Zero-Day | Wordfence Security News #17

    The Events Calendar RCE, N-central Takeover & Magento Zero-Day | Wordfence Security News #17 This week in Wordfence Security News (Week of September 14, 2026): The Events Calendar patched two critical RCE chains on September 10; Wordfence logged the first exploit attempt 2.2 hours after disclosure.Wordfence's firewall matched 3,285 requests across 619 sites in four and a half days, 2,103 consistent with exploitation.N-able fixed a maximum severity pre-auth RCE in N-central; CISA's federal remediation deadline of September 11 has passed.StyleSmuggler hit Adobe Commerce and Magento Open Source on September 4, three days before Adobe's CVSS 10.0 hotfix.GitLab patched a critical unauthenticated path traversal on September 10; attackers probed it within 24 hours of disclosure.Chrome's September 8 update shipped 230 security fixes, including a medium-rated V8 out-of-bounds write exploited in the wild.Timestamps: 0:00 Introduction 0:35 The Events Calendar unauthenticated object injection to RCE 2:42 N-able N-central pre-authentication RCE 3:49 StyleSmuggler Adobe Commerce and Magento zero-day 4:57 GitLab repository Commits API path traversal 5:38 Chrome/Chromium V8 out-of-bounds write Story Links: The Events Calendar unauthenticated object injection to RCEWordfence Argus identifies two critical unauthenticated RCE chains in The Events Calendar (Wordfence blog)N-able N-central pre-authentication RCEStyleSmuggler Adobe Commerce and Magento zero-dayGitLab repository Commits API path traversalChrome/Chromium V8 out-of-bounds write Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter. (00:00) - Introduction (00:35) - The Events Calendar unauthenticated object injection to RCE (02:42) - N-able N-central pre-authentication RCE (03:49) - StyleSmuggler Adobe Commerce and Magento zero-day (04:57) - GitLab repository Commits API path traversal (05:38) - Chrome/Chromium V8 out-of-bounds write

    The Events Calendar RCE, N-central Takeover & Magento Zero-Day | Wordfence Security News #17

  3. Aug 14

    WP2Shell RCE, SonicWall Zero-Days & ServiceNow Exploit | Wordfence Security News #16

    WP2Shell RCE, SonicWall Zero-Days & ServiceNow Exploit | Wordfence Security News #16 This week in Wordfence Security News (Week of July 20, 2026): WP2Shell chains two WordPress core bugs into unauthenticated RCE on default installs of 6.9 and 7.0; CISA added both flaws to its KEV catalog on July 21.Attackers had root on SonicWall SMA 1000 VPN appliances for about three weeks before the July 14 advisory, capturing LDAP credentials off the wire.A separate Palo Alto GlobalProtect authentication bypass was the way in for June intrusions that ended in Qilin ransomware.A pre-auth ServiceNow AI Platform sandbox escape was exploited three days after its write-up went public; self-hosted and partner-managed instances are at risk.CISA added a 2008 Cisco IOS flaw to its KEV catalog as allied agencies warned of an FSB unit copying router configurations over weak SNMP.OpenAI says its own models escaped an evaluation sandbox and hacked Hugging Face to grab benchmark answers.The Jscrambler and AsyncAPI npm compromises stole developer secrets in ways that disabling install scripts would not stop.Timestamps: 0:00 Introduction 0:48 WP2Shell WordPress core unauthenticated RCE 5:38 SonicWall SMA 1000 VPN zero-days 7:50 ServiceNow AI Platform pre-auth RCE 9:22 2008 Cisco IOS flaw added to CISA KEV 11:30 OpenAI models hack Hugging Face 14:16 AsyncAPI and Jscrambler npm compromises Story Links: PSA: WordPress Core patched unauthenticated RCE vulnerability chain (Wordfence)wp2shell aftermath: the first critical unauthenticated WordPress core RCE in nearly a decade (Wordfence)WP2Shell exploit technical analysis and real attack data (Wordfence)WP2Shell: pre-authentication RCE in WordPress coreSonicWall SMA 1000 VPN zero-day exploitationPalo Alto GlobalProtect bypass leads to Qilin ransomwareServiceNow AI Platform pre-auth RCE (CVE-2026-6875)CISA adds 2008 Cisco IOS flaw to KEVJoint advisory on FSB targeting of network devicesOpenAI on the Hugging Face model evaluation incidentAsyncAPI npm supply chain compromise (Microsoft)Jscrambler supply chain attack (Socket) Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter. (00:00) - Introduction (00:48) - WP2Shell WordPress core unauthenticated RCE (05:38) - SonicWall SMA 1000 VPN zero-days (07:50) - ServiceNow AI Platform pre-auth RCE (09:22) - 2008 Cisco IOS flaw added to CISA KEV (11:30) - OpenAI models hack Hugging Face (14:16) - AsyncAPI and Jscrambler npm compromises

    WP2Shell RCE, SonicWall Zero-Days & ServiceNow Exploit | Wordfence Security News #16

  4. Aug 7

    WordPress Backdoors, NetScaler Bleed & AI Ransomware | Wordfence Security News #15

    WordPress Backdoors, NetScaler Bleed & AI Ransomware | Wordfence Security News #15 This week in Wordfence Security News (Week of July 13, 2026): Exposed hacker server reveals mass WordPress backdooring op chaining 27 known flaws; over 25,000 sites with confirmed or validated compromiseCritical Adobe ColdFusion path traversal patched June 30 saw exploitation attempts within hours of technical details going publicSharePoint Server on-prem RCE Microsoft rated exploitation less likely added to CISA's exploited catalog July 1New NetScaler pre-auth memory overread leaks process memory on SAML IdP configs, echoing CitrixBleedRoguePlanet, a fourth Defender flaw from the BlueHammer researcher, escalates a local attacker to systemSysdig assesses the first documented agentic ransomware case: an AI agent encrypted 1,342 config items via a Langflow flawSymlink trick in a booby-trapped GitHub repo fools six AI coding assistants into writing an attacker SSH keyTimestamps: 0:00 Introduction 0:52 WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring Operation 4:39 Adobe ColdFusion Flaw Exploited After Details Go Public 6:08 SharePoint Flaw Microsoft Called Unlikely Is Now on CISA's List 7:21 New NetScaler Flaw Echoes CitrixBleed 8:19 Microsoft Patches RoguePlanet, Fourth Defender Flaw from Same Researcher 9:14 Researchers Describe Possible First AI-Run Ransomware Attack 11:27 Symlink Trick Fools Six AI Coding Assistants Story Links: WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring OperationAdobe ColdFusion Flaw Exploited After Details Go PublicSharePoint Flaw Microsoft Called Unlikely Is Now on CISA's ListNew NetScaler Flaw Echoes CitrixBleedMicrosoft Patches RoguePlanet, Fourth Defender Flaw from Same ResearcherResearchers Describe Possible First AI-Run Ransomware AttackSymlink Trick Fools Six AI Coding Assistants Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter. (00:00) - Introduction (00:52) - WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring Operation (04:39) - Adobe ColdFusion Flaw Exploited After Details Go Public (06:08) - SharePoint Flaw Microsoft Called Unlikely Is Now on CISA's List (07:21) - New NetScaler Flaw Echoes CitrixBleed (08:19) - Microsoft Patches RoguePlanet, Fourth Defender Flaw from Same Researcher (09:14) - Researchers Describe Possible First AI-Run Ransomware Attack (11:27) - Symlink Trick Fools Six AI Coding Assistants

    WordPress Backdoors, NetScaler Bleed & AI Ransomware | Wordfence Security News #15

  5. Jul 31

    OMGF Pro Exploited, Oracle Payments Attack & AI Repo Backdoor | Wordfence Security News #14

    OMGF Pro Exploited, Oracle Payments Attack & AI Repo Backdoor | Wordfence Security News #14 This week in Wordfence Security News: OMGF Pro unauthenticated file upload exploited during disclosure: 60,000+ blocked attempts across nearly 8,000 sites, fixed in 5.2.7Oracle E-Business Suite Payments auth bypass exploited in the wild despite a May patch; Shadowserver tracked around 950 exposed EBS instancesPTC Windchill and FlexPLM unauthenticated RCE added to CISA KEV on June 25 after attackers deployed JSP web shellsBlueHammer, the deliberately leaked Microsoft Defender flaw, now flagged by CISA as used in ransomware attacksSimpleHelp OIDC signature flaw grants fake technician accounts, dropping the Taskweaver loader and Djinn info stealerMozilla 0DIN demo shows a clean GitHub repo tricking Claude Code into fetching a DNS TXT payload and opening a shellTimestamps: 0:00 Introduction 0:48 Active Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload 3:42 Oracle E-Business Suite Payments Exploited in the Wild 5:21 PTC Windchill / FlexPLM RCE Added to CISA KEV 6:21 BlueHammer Microsoft Defender Flaw Used in Ransomware Attacks 6:57 SimpleHelp Auth Bypass Exploited to Deploy Djinn Stealer 8:46 Clean GitHub Repo Tricks AI Coding Agents Into Running Malware Story Links: Active Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload During Responsible Disclosure Window.Oracle E-Business Suite Payments Exploited in the WildPTC Windchill / FlexPLM RCE Added to CISA KEVBlueHammer Microsoft Defender Vulnerability Exploited in Ransomware AttacksSimpleHelp Auth Bypass Exploited to Deploy Djinn StealerClean GitHub Repo Tricks AI Coding Agents Into Running Malware / Mozilla 0DIN Claude Code Demo Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

    OMGF Pro Exploited, Oracle Payments Attack & AI Repo Backdoor | Wordfence Security News #14

  6. Jul 9

    Uncanny Automator Backdoor, Splunk Exploited & AI Key Theft | Wordfence Security News #13

    Uncanny Automator Backdoor, Splunk Exploited & AI Key Theft This week in Wordfence Security News (Week of June 23, 2026): • Uncanny Automator Pro Backdoored Through Update Server• Splunk Enterprise Flaw Exploited in the Wild• Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls• LiteLLM Flaw Puts AI Gateway Keys at Risk• Malicious JetBrains Plugins Stole AI API Keys Timestamps: 00:00 Intro00:37 Uncanny Automator Pro Backdoored Through Update Server06:08 Splunk Enterprise Flaw Exploited in the Wild08:54 Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls11:49 LiteLLM Flaw Puts AI Gateway Keys at Risk14:39 Malicious JetBrains Plugins Stole AI API Keys Story Links: 1. Uncanny Automator Pro Backdoored Through Update Server 2. Splunk Enterprise Flaw Exploited in the Wild 3. Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls 4. LiteLLM Flaw Puts AI Gateway Keys at Risk 5. Malicious JetBrains Plugins Stole AI API Keys Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

    Uncanny Automator Backdoor, Splunk Exploited & AI Key Theft | Wordfence Security News #13

  7. Jun 26

    WordPress Plugin Supply Chain Attacks, Ivanti CVSS 10 & phpBB Hijacks | Wordfence Security News #12

    WordPress Supply Chain Attacks, Ivanti Root Flaw, and phpBB Account Takeovers This week in Wordfence Security News (Week of June 15, 2026): ShapedPlugin's paid pro plugins were backdoored via the vendor's update system, stealing passwords and 2FA secretsOptinMonster, TrustPulse, and PushEngage served a tampered CDN script that targeted logged-in adminsOracle PeopleSoft zero-day exploited by ShinyHunters hit 300+ systems, 68% in higher educationIvanti Sentry CVSS 10 OS command injection flaw gives attackers root, added to CISA KEVLangflow AI app builder path traversal flaw now actively exploited against unpatched instancesphpBB authentication bypass lets attackers hijack any account with just a username and one requestTimestamps: 0:00 Introduction 0:42 ShapedPlugin Multiple Plugins Supply Chain Compromised 5:11 OptinMonster / TrustPulse / PushEngage Tampered Script Served via Compromised CDN 7:48 Oracle PeopleSoft Zero-Day Exploited by ShinyHunters 10:17 Ivanti Sentry CVSS 10 RCE Added to KEV 11:53 Langflow RCE Actively Exploited Against Exposed AI App Builders 13:46 phpBB Authentication Bypass Lets Attackers Hijack Accounts Story Links: ShapedPlugin Multiple Plugins Supply Chain CompromisedOptinMonster / TrustPulse / PushEngage Tampered Script Served via Compromised CDNOracle PeopleSoft Zero-Day Exploited by ShinyHuntersIvanti Sentry CVSS 10 RCE Added to KEVLangflow RCE Actively Exploited Against Exposed AI App BuildersphpBB Authentication Bypass Lets Attackers Hijack AccountsStay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

    WordPress Plugin Supply Chain Attacks, Ivanti CVSS 10 & phpBB Hijacks | Wordfence Security News #12

  8. Jun 18

    Kirki & UpdraftPlus Exploits, Miasma Supply Chain Worm & 3 Zero-Days | Wordfence Security News #11

    Kirki & UpdraftPlus Exploited, Miasma Supply Chain Worm & 3 Zero-Days | Wordfence Security News #11 In this episode of Wordfence Security News: Kirki's password reset endpoint lets unauthenticated attackers redirect admin reset links to any inbox, enabling full account takeover.UpdraftPlus UpdraftCentral auth bypass allows unauthenticated attackers to install plugins and achieve remote code execution on connected sites.Check Point Remote Access VPN zero-day exploited since May 7 lets attackers bypass credentials entirely; one intrusion tied to Qilin ransomware affiliate.Cisco Catalyst SD-WAN Manager zero-day command injection, chainable with two auth bypasses, lets attackers push rogue config to all edge devices as root.Chrome 149 patches 429 vulnerabilities - nearly triple the previous record - including 22 critical CVEs, with $208,000 in bounty rewards paid out.Miasma supply chain worm hit 113+ GitHub repositories by planting AI coding tool config files that exfiltrate cloud credentials on folder open. Timestamps: 0:00 Introduction 0:39 Kirki Password Reset Exploit Goes Live 2:59 UpdraftPlus UpdraftCentral Auth Bypass to RCE 6:50 Check Point VPN Zero-Day Exploited by Qilin Ransomware Affiliate 8:59 Cisco SD-WAN Manager Zero-Day Exploited to Gain Root 11:20 Chrome 149 Ships Record Browser Security Update 13:20 Miasma Worm Targets Developer Workflows and AI Coding Tools Story Links: Kirki Password Reset Exploit Goes LiveUpdraftPlus UpdraftCentral Auth Bypass to RCECheck Point VPN Zero-Day Exploited by Qilin Ransomware AffiliateCisco SD-WAN Manager Zero-Day Exploited to Gain RootChrome 149 Ships Record Browser Security UpdateMiasma Worm Targets Developer Workflows and AI Coding Tools Stay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.

    Kirki & UpdraftPlus Exploits, Miasma Supply Chain Worm & 3 Zero-Days | Wordfence Security News #11
See All (18)

Ratings & Reviews

5
out of 5
3 Ratings

About

Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.

Information

  • Creator
    Wordfence
  • Years Active
    2026
  • Episodes
    18
  • Rating
    Clean
  • Copyright
    © 2012-2026 Defiant Inc. All Rights Reserved
  • Show Website
    Wordfence Security News