Wordfence Security News

Wordfence
  • 5.0 (3)
  • Tech News
  • Weekly

Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.

  1. Oct 30 ·  Video

    Wordfence Argus Finds Ghostscript RCE, Jira Leak & Crypto-Mining Hacks | Wordfence Security News #20

    Wordfence Argus Finds Ghostscript RCE, Jira Leak & Crypto-Mining Hacks | Wordfence Security News #20 This week in Wordfence Security News (Week of October 12, 2026): Wordfence Argus found a critical Ghostscript flaw that lets a crafted PDF run code on servers generating WordPress PDF previews, fixed in Ghostscript 10.08.0.Critical Atlassian file read flaw in eight self-managed products drew 386 attack attempts from 60 IP addresses after watchTowr published exploit code.Attackers chained two AhsayCBS backup flaws to gain system-level control, leave hidden access, and install a cryptominer disguised as Microsoft Edge.Ledger found an LTE implant in tampered wallets sold by CryptoBilis that captured 24-word recovery phrases during setup and sent them over cellular.Attackers forced refrigeration systems into defrost at more than 500 French stores; CERT-FR now lists Danfoss, Copeland, and Dixell controllers.Timestamps: 0:00 Introduction 0:42 Wordfence Argus Finds Critical Ghostscript Flaw 3:17 Atlassian File Read Flaw in Eight Self-Managed Products 4:56 AhsayCBS Backup Flaws Exploited 6:49 Ledger Finds LTE Implant in Tampered Wallets 8:26 Refrigeration Defrost Attack at 500+ French Stores Story Links: Wordfence Argus finds critical Ghostscript flaw behind WordPress PDF previewsAtlassian file read flaw in eight self-managed products exploited after public PoC (CVE-2026-21589)AhsayCBS backup flaws exploited to drop webshells and a cryptominerLedger finds LTE implant in tampered wallets sold by CryptoBilisAttackers force refrigeration defrost at 500+ French stores; CERT-FR widens to Copeland and Dixell Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

    Wordfence Argus Finds Ghostscript RCE, Jira Leak & Crypto-Mining Hacks | Wordfence Security News #20

  2. Oct 23

    WordPress Core RCE, PeopleSoft WAF Bypass & Citrix NetScaler Zero-Days | Wordfence Security News #19

    WordPress Core RCE, PeopleSoft WAF Bypass & Citrix NetScaler Zero-Days | Wordfence Security News #19 This week in Wordfence Security News (Week of September 28, 2026): Unauthenticated WordPress core file inclusion flaw drew more than 4.27 million requests matching the Wordfence firewall rule.ShinyHunters resumed mass exploitation of a critical Oracle PeopleSoft flaw, bypassing firewall rules by encoding one character.Two critical Citrix NetScaler flaws were exploited before Citrix disclosed them on September 27, with a September 30 federal deadline.Two GitHub Actions compromised in May became reachable again September 16-25 with malicious release tags intact.Apple patched a CoreGraphics flaw that may have been used in an extremely sophisticated attack on targeted individuals.Timestamps: 0:00 Introduction 0:40 WordPress core file inclusion: 4.27 million requests captured 3:13 ShinyHunters bypasses WAF rules targeting Oracle PeopleSoft 5:15 Citrix NetScaler flaws exploited - federal deadline September 30 6:37 Compromised GitHub Actions switched back on for over a week 8:04 Apple patches CoreGraphics flaw possibly used in targeted attack Story Links: WordPress core file inclusion: 4.27 million requests capturedWordfence PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress CoreShinyHunters bypasses WAF rules targeting Oracle PeopleSoftCitrix NetScaler flaws exploited - federal deadline September 30Compromised GitHub Actions switched back on for over a weekApple patches CoreGraphics flaw possibly used in targeted attack Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

    WordPress Core RCE, PeopleSoft WAF Bypass & Citrix NetScaler Zero-Days | Wordfence Security News #19

  3. Oct 16

    libheif RCE, All-in-One WP Migration SQLi & Exploited Cisco Flaws | Wordfence Security News #18

    libheif RCE, All-in-One WP Migration SQLi & Exploited Cisco Flaws | Wordfence Security News #18 This week in Wordfence Security News (Week of September 28, 2026): Wordfence Argus found a critical CVSS 9.8 heap overflow in libheif, the system library that decodes iPhone HEIC photos on Linux servers.The official WordPress Docker image, Debian 13, Ubuntu 26.04 and Fedora 44 were vulnerable out of the box; the fix landed in libheif 1.23.3.SQL injection in All-in-One WP Migration and Backup (5 million installs) through 7.109 drew probing against 881 sites; patched in 7.110.Cisco Secure Email Gateway AsyncOS SQL injection is on CISA's exploited list, with no workaround and a federal deadline that passed September 17.Sandworm and a Qilin ransomware crew exploited two Cisco Secure Firewall Management Center flaws, including a CVSS 10 auth bypass.Twitch Enhanced Viewer, with roughly 30,000 Chrome users, forwarded live OAuth session tokens to a third-party bot service; fixed in 85.8.7.Timestamps: 0:00 Introduction 0:39 Wordfence Argus finds critical libheif flaw (iPhone photo library) 3:18 All-in-One WP Migration and Backup archive restore SQL injection 4:55 Cisco Secure Email Gateway SQL injection 6:34 Cisco Secure Firewall Management Center flaws under active exploitation 8:07 Twitch extension forwarded viewer session tokens to a Russian bot service Story Links: Wordfence Argus finds critical libheif flaw (iPhone photo library)All-in-One WP Migration and Backup archive restore SQL injectionCisco Secure Email Gateway SQL injectionCisco Secure Firewall Management Center flaws under active exploitationTwitch extension forwarded viewer session tokens to a Russian bot service Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter. (00:00) - Introduction (00:39) - Wordfence Argus finds critical libheif flaw (iPhone photo library) (03:18) - All-in-One WP Migration and Backup archive restore SQL injection (04:55) - Cisco Secure Email Gateway SQL injection (06:30) - Cisco Secure Firewall Management Center flaws under active exploitation (08:07) - Twitch extension forwarded viewer session tokens to a Russian bot service

    libheif RCE, All-in-One WP Migration SQLi & Exploited Cisco Flaws | Wordfence Security News #18

  4. Oct 2

    The Events Calendar RCE, N-central Takeover & Magento Zero-Day | Wordfence Security News #17

    The Events Calendar RCE, N-central Takeover & Magento Zero-Day | Wordfence Security News #17 This week in Wordfence Security News (Week of September 14, 2026): The Events Calendar patched two critical RCE chains on September 10; Wordfence logged the first exploit attempt 2.2 hours after disclosure.Wordfence's firewall matched 3,285 requests across 619 sites in four and a half days, 2,103 consistent with exploitation.N-able fixed a maximum severity pre-auth RCE in N-central; CISA's federal remediation deadline of September 11 has passed.StyleSmuggler hit Adobe Commerce and Magento Open Source on September 4, three days before Adobe's CVSS 10.0 hotfix.GitLab patched a critical unauthenticated path traversal on September 10; attackers probed it within 24 hours of disclosure.Chrome's September 8 update shipped 230 security fixes, including a medium-rated V8 out-of-bounds write exploited in the wild.Timestamps: 0:00 Introduction 0:35 The Events Calendar unauthenticated object injection to RCE 2:42 N-able N-central pre-authentication RCE 3:49 StyleSmuggler Adobe Commerce and Magento zero-day 4:57 GitLab repository Commits API path traversal 5:38 Chrome/Chromium V8 out-of-bounds write Story Links: The Events Calendar unauthenticated object injection to RCEWordfence Argus identifies two critical unauthenticated RCE chains in The Events Calendar (Wordfence blog)N-able N-central pre-authentication RCEStyleSmuggler Adobe Commerce and Magento zero-dayGitLab repository Commits API path traversalChrome/Chromium V8 out-of-bounds write Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter. (00:00) - Introduction (00:35) - The Events Calendar unauthenticated object injection to RCE (02:42) - N-able N-central pre-authentication RCE (03:49) - StyleSmuggler Adobe Commerce and Magento zero-day (04:57) - GitLab repository Commits API path traversal (05:38) - Chrome/Chromium V8 out-of-bounds write

    The Events Calendar RCE, N-central Takeover & Magento Zero-Day | Wordfence Security News #17

  5. Aug 14

    WP2Shell RCE, SonicWall Zero-Days & ServiceNow Exploit | Wordfence Security News #16

    WP2Shell RCE, SonicWall Zero-Days & ServiceNow Exploit | Wordfence Security News #16 This week in Wordfence Security News (Week of July 20, 2026): WP2Shell chains two WordPress core bugs into unauthenticated RCE on default installs of 6.9 and 7.0; CISA added both flaws to its KEV catalog on July 21.Attackers had root on SonicWall SMA 1000 VPN appliances for about three weeks before the July 14 advisory, capturing LDAP credentials off the wire.A separate Palo Alto GlobalProtect authentication bypass was the way in for June intrusions that ended in Qilin ransomware.A pre-auth ServiceNow AI Platform sandbox escape was exploited three days after its write-up went public; self-hosted and partner-managed instances are at risk.CISA added a 2008 Cisco IOS flaw to its KEV catalog as allied agencies warned of an FSB unit copying router configurations over weak SNMP.OpenAI says its own models escaped an evaluation sandbox and hacked Hugging Face to grab benchmark answers.The Jscrambler and AsyncAPI npm compromises stole developer secrets in ways that disabling install scripts would not stop.Timestamps: 0:00 Introduction 0:48 WP2Shell WordPress core unauthenticated RCE 5:38 SonicWall SMA 1000 VPN zero-days 7:50 ServiceNow AI Platform pre-auth RCE 9:22 2008 Cisco IOS flaw added to CISA KEV 11:30 OpenAI models hack Hugging Face 14:16 AsyncAPI and Jscrambler npm compromises Story Links: PSA: WordPress Core patched unauthenticated RCE vulnerability chain (Wordfence)wp2shell aftermath: the first critical unauthenticated WordPress core RCE in nearly a decade (Wordfence)WP2Shell exploit technical analysis and real attack data (Wordfence)WP2Shell: pre-authentication RCE in WordPress coreSonicWall SMA 1000 VPN zero-day exploitationPalo Alto GlobalProtect bypass leads to Qilin ransomwareServiceNow AI Platform pre-auth RCE (CVE-2026-6875)CISA adds 2008 Cisco IOS flaw to KEVJoint advisory on FSB targeting of network devicesOpenAI on the Hugging Face model evaluation incidentAsyncAPI npm supply chain compromise (Microsoft)Jscrambler supply chain attack (Socket) Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter. (00:00) - Introduction (00:48) - WP2Shell WordPress core unauthenticated RCE (05:38) - SonicWall SMA 1000 VPN zero-days (07:50) - ServiceNow AI Platform pre-auth RCE (09:22) - 2008 Cisco IOS flaw added to CISA KEV (11:30) - OpenAI models hack Hugging Face (14:16) - AsyncAPI and Jscrambler npm compromises

    WP2Shell RCE, SonicWall Zero-Days & ServiceNow Exploit | Wordfence Security News #16

  6. Aug 7

    WordPress Backdoors, NetScaler Bleed & AI Ransomware | Wordfence Security News #15

    WordPress Backdoors, NetScaler Bleed & AI Ransomware | Wordfence Security News #15 This week in Wordfence Security News (Week of July 13, 2026): Exposed hacker server reveals mass WordPress backdooring op chaining 27 known flaws; over 25,000 sites with confirmed or validated compromiseCritical Adobe ColdFusion path traversal patched June 30 saw exploitation attempts within hours of technical details going publicSharePoint Server on-prem RCE Microsoft rated exploitation less likely added to CISA's exploited catalog July 1New NetScaler pre-auth memory overread leaks process memory on SAML IdP configs, echoing CitrixBleedRoguePlanet, a fourth Defender flaw from the BlueHammer researcher, escalates a local attacker to systemSysdig assesses the first documented agentic ransomware case: an AI agent encrypted 1,342 config items via a Langflow flawSymlink trick in a booby-trapped GitHub repo fools six AI coding assistants into writing an attacker SSH keyTimestamps: 0:00 Introduction 0:52 WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring Operation 4:39 Adobe ColdFusion Flaw Exploited After Details Go Public 6:08 SharePoint Flaw Microsoft Called Unlikely Is Now on CISA's List 7:21 New NetScaler Flaw Echoes CitrixBleed 8:19 Microsoft Patches RoguePlanet, Fourth Defender Flaw from Same Researcher 9:14 Researchers Describe Possible First AI-Run Ransomware Attack 11:27 Symlink Trick Fools Six AI Coding Assistants Story Links: WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring OperationAdobe ColdFusion Flaw Exploited After Details Go PublicSharePoint Flaw Microsoft Called Unlikely Is Now on CISA's ListNew NetScaler Flaw Echoes CitrixBleedMicrosoft Patches RoguePlanet, Fourth Defender Flaw from Same ResearcherResearchers Describe Possible First AI-Run Ransomware AttackSymlink Trick Fools Six AI Coding Assistants Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter. (00:00) - Introduction (00:52) - WP-SHELLSTORM: Open Server Exposes Mass WordPress Backdooring Operation (04:39) - Adobe ColdFusion Flaw Exploited After Details Go Public (06:08) - SharePoint Flaw Microsoft Called Unlikely Is Now on CISA's List (07:21) - New NetScaler Flaw Echoes CitrixBleed (08:19) - Microsoft Patches RoguePlanet, Fourth Defender Flaw from Same Researcher (09:14) - Researchers Describe Possible First AI-Run Ransomware Attack (11:27) - Symlink Trick Fools Six AI Coding Assistants

    WordPress Backdoors, NetScaler Bleed & AI Ransomware | Wordfence Security News #15

  7. Jul 31

    OMGF Pro Exploited, Oracle Payments Attack & AI Repo Backdoor | Wordfence Security News #14

    OMGF Pro Exploited, Oracle Payments Attack & AI Repo Backdoor | Wordfence Security News #14 This week in Wordfence Security News: OMGF Pro unauthenticated file upload exploited during disclosure: 60,000+ blocked attempts across nearly 8,000 sites, fixed in 5.2.7Oracle E-Business Suite Payments auth bypass exploited in the wild despite a May patch; Shadowserver tracked around 950 exposed EBS instancesPTC Windchill and FlexPLM unauthenticated RCE added to CISA KEV on June 25 after attackers deployed JSP web shellsBlueHammer, the deliberately leaked Microsoft Defender flaw, now flagged by CISA as used in ransomware attacksSimpleHelp OIDC signature flaw grants fake technician accounts, dropping the Taskweaver loader and Djinn info stealerMozilla 0DIN demo shows a clean GitHub repo tricking Claude Code into fetching a DNS TXT payload and opening a shellTimestamps: 0:00 Introduction 0:48 Active Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload 3:42 Oracle E-Business Suite Payments Exploited in the Wild 5:21 PTC Windchill / FlexPLM RCE Added to CISA KEV 6:21 BlueHammer Microsoft Defender Flaw Used in Ransomware Attacks 6:57 SimpleHelp Auth Bypass Exploited to Deploy Djinn Stealer 8:46 Clean GitHub Repo Tricks AI Coding Agents Into Running Malware Story Links: Active Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload During Responsible Disclosure Window.Oracle E-Business Suite Payments Exploited in the WildPTC Windchill / FlexPLM RCE Added to CISA KEVBlueHammer Microsoft Defender Vulnerability Exploited in Ransomware AttacksSimpleHelp Auth Bypass Exploited to Deploy Djinn StealerClean GitHub Repo Tricks AI Coding Agents Into Running Malware / Mozilla 0DIN Claude Code Demo Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

    OMGF Pro Exploited, Oracle Payments Attack & AI Repo Backdoor | Wordfence Security News #14

  8. Jul 9

    Uncanny Automator Backdoor, Splunk Exploited & AI Key Theft | Wordfence Security News #13

    Uncanny Automator Backdoor, Splunk Exploited & AI Key Theft This week in Wordfence Security News (Week of June 23, 2026): • Uncanny Automator Pro Backdoored Through Update Server• Splunk Enterprise Flaw Exploited in the Wild• Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls• LiteLLM Flaw Puts AI Gateway Keys at Risk• Malicious JetBrains Plugins Stole AI API Keys Timestamps: 00:00 Intro00:37 Uncanny Automator Pro Backdoored Through Update Server06:08 Splunk Enterprise Flaw Exploited in the Wild08:54 Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls11:49 LiteLLM Flaw Puts AI Gateway Keys at Risk14:39 Malicious JetBrains Plugins Stole AI API Keys Story Links: 1. Uncanny Automator Pro Backdoored Through Update Server 2. Splunk Enterprise Flaw Exploited in the Wild 3. Fortinet Sandbox Flaws Targeted as FortiBleed Hits Firewalls 4. LiteLLM Flaw Puts AI Gateway Keys at Risk 5. Malicious JetBrains Plugins Stole AI API Keys Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.

    Uncanny Automator Backdoor, Splunk Exploited & AI Key Theft | Wordfence Security News #13
See All (20)

Ratings & Reviews

5
out of 5
3 Ratings

About

Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.

Information

  • Creator
    Wordfence
  • Years Active
    2026
  • Episodes
    20
  • Rating
    Clean
  • Copyright
    © 2012-2026 Defiant Inc. All Rights Reserved
  • Show Website
    Wordfence Security News