#wordpress-security
#wordpress-security
[ follow ]
#cybersecurity #malware #supply-chain-attack #vulnerabilities #security #data-breach #axios #social-engineering
Privacy professionals
fromSilicon Canals
3 days agoA money-transfer app stored customer passports on an unencrypted, publicly accessible server for nearly five years - Silicon Canals
Fintech companies face regulatory pressure to collect identity documents but lack enforceable obligations to protect them, leading to data breaches.
#data-breach
Privacy technologies
fromTechCrunch
3 days agoExclusive: Money transfer app Duc exposed thousands of driver's licenses and passports to the open web
A publicly accessible Amazon storage server exposed personal data of hundreds of thousands, including driver's licenses and passports, without encryption.
fromDevOps.com
4 hours agoIs Your AI Agent Secure? The DevOps Case for Adversarial QA Testing - DevOps.com
The most dangerous assumption in quality engineering right now is that you can validate an autonomous testing agent the same way you validated a deterministic application. When your systems can reason, adapt, and make decisions on their own, that linear validation model collapses.
Information security
Web development
fromTheregister
3 weeks agoBrilliant backups landed web developer in big trouble
A website migration oversight caused a two-year disconnect where office staff viewed outdated content due to hardcoded DNS settings, while the client only discovered the issue when accessing the site from the office.
#supply-chain-attack
Information security
fromSecurityWeek
3 weeks agoPolyfill Supply Chain Attack Impacting 100k Sites Linked to North Korea
The 2024 Polyfill.io supply chain attack affecting over 100,000 websites involved both Chinese and North Korean threat actors, with Funnull serving as a corporate front for the operation.
#malware
Information security
fromTechRepublic
4 days agoMicrosoft: Hackers Are Using WhatsApp to Deliver Malware to Windows PCs
WhatsApp messages are being exploited to deliver malware to Windows users, creating significant security risks.
fromThe Hacker News
4 days agoNew Chrome Zero-Day CVE-2026-5281 Under Active Exploitation - Patch Released
"Use-after-free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page."
Information security
Information security
fromTechRepublic
3 weeks agoSecurity Flaw in WordPress Plugin Puts 400,000 Websites at Risk
A critical vulnerability in the Ally WordPress plugin allows unauthenticated attackers to extract sensitive database data including password hashes from hundreds of thousands of affected websites.
fromSecurityWeek
3 weeks agoAlly WordPress Plugin Flaw Exposes Over 200,000 Websites to Attacks
This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques.
Information security
Information security
fromTheregister
3 weeks agoCrooks compromise WordPress sites, spread infostealers
Attackers compromised legitimate WordPress sites including a US Senate candidate's website to distribute infostealer malware through fake Cloudflare CAPTCHA pages that trick users into running malicious commands.
Information security
fromSecurityWeek
3 weeks agoCritical N8n Vulnerabilities Allowed Server Takeover
Two critical vulnerabilities in n8n allowed unauthenticated remote code execution and sandbox escape, potentially exposing all stored credentials including AWS keys, passwords, OAuth tokens, and API keys.
Information security
fromThe Hacker News
4 weeks agoWeb Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure
Chinese threat actor CL-UNK-1068 conducted years-long cyber espionage campaign targeting high-value organizations across aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors in South, Southeast, and East Asia.
fromZDNET
1 month agoHalf of all cyberattacks start in your browser: 10 essential tips for staying safe
Web browsers are among the top targets for today's cybercriminals, playing a role in nearly half of all security incidents, new research reveals. According to Palo Alto Networks' 2026 Global Incident Response report, an analysis of 750 major cyber incidents recorded last year across 50 countries found that, in total, 48% of cybercrime events involved browser activity. Individuals trying to connect to the web, including business employees, are exposed to cyberthreats on a daily basis.
Information security
[ Load more ]