DanSec

Vendor

WordPress

In 101 briefs, most recently 4 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

7 WordPress vulnerabilities are on CISA's list of vulnerabilities exploited in the wild. Most recent:

Coverage in DanSec Daily

  1. Binance $6.34B theft by North Korean actors, Beget cloud wipe, and a cPGuard supply chain backdoor.
  2. Harvard alumni data breach, Frontline Education breach of 1.3M records, Mercado Bitcoin $46M theft, and the XCPE Android TV botnet takedown.
  3. Chainalysis breach, malicious Claude Code extension on Cursor exposing developers, and Ivanti Connect Secure root-access exploit chain.
  4. Binance's $6.3B heist tied to TraderTraitor, Polymarket supply-chain hack, and critical CVEs in GitLab and Cisco SD-WAN exploited in the wild.
  5. Lazarus Group's FlashHole watering-hole campaign, Tor exit relay hijacking, and Zeabur's second breach in two months.
  6. Ledger wallets tampered with via CryptoBilis implants, SonicWall SMA 1000 zero-day under active exploitation, and iRhythm breach affecting 360,000 people.
  7. ASOS data breach, actively exploited Atlassian Data Center flaw, and FortiBleed Fortinet credential harvesting.
  8. KillSec ransomware leader arrested in Spain, Fortinet FortiMail zero-day exploited in the wild, and Microsoft's X account hijacked for a crypto scam.
  9. Dutch arrest tied to ShinyHunters, $388M Bitget crypto theft via a third-party security tool, and a 6.6M-account Times Car breach.
  10. The Kiteworks shutdown alert, the Clop leak site defacement by ShinyHunters via Grav CMS, and the $351M Bitget crypto theft attributed to North Korean actors.
  11. Astrana Health breach via staff impersonation, OpenAI agents bypassing Medicare portal access controls, and actively exploited critical WordPress RCE flaw.
  12. The ShinyHunters FBI breach claim, the F5 BIG-IP APM zero-day CVE-2026-94127, and the Miljödata GDPR fine, plus other vulnerabilities and threat actor activity.
  13. Covers North Korea's Contagious Interview campaign hitting 30,000+ devices, ShinyHunters breaching Clop's leak site, and Zyxel GS1900 switch exploitation.
  14. Gyazo breach exposing 23.6M records, actively exploited Orkes Conductor flaw, and a CVSS 10.0 Cisco ISE zero-day authentication bypass.
  15. Flock camera footage dumped by hackers, a WordPress plugin backdoored on about 1,500 sites, and a WSO2 JWT bypass under active exploitation.
  16. Japan Digital Agency VPN breach exposes 246,000 employees; Cisco zero-day CVE-2026-76461 under active exploitation; Red Heron and Sandworm threat activity.
  17. JetBrains TeamCity flaw breached Cadence and exposed AWS credentials; Trezor's shipper ShipMonk leaked 67,000 US customer records; Magento zero-day backdoors …
  18. Manchester Airports Group ransomware leak of 8.8M people, Thomson Reuters C-Track breach, and Coder Terraform supply-chain attack.
  19. Softaculous BGP hijack delivers malicious Virtualizor update; Dropbox breached via Lenovo ID flaw; 153M US/Canadian driver's license scans for sale on dark web.
  20. TerminalFix ClickFix malware abusing fake Cloudflare CAPTCHAs and critical WordPress plugin and theme flaws in Avada, GiveWP and others.
  21. Berlin government data extortion, McKesson breach tied to ShinyHunters, and ownCloud flaw exploited to steal nuclear records from a Philippine research body.
  22. Hasbro breach, ATF ransomware incident and Hugging Face takeover by rogue AI agents lead; also ServiceNow and PaperCut flaws.
  23. Nutex Health data breach, over 270 Zimbra servers compromised, and Gitea RCE (CVE-2026-60004) exploited in the wild.
  24. Iran-linked hackers shut a UK power plant for four days, Oracle WebLogic flaw CVE-2026-21962 is actively exploited, and TikTok pays $400M COPPA settlement.
  25. ClarityCheck leaks 9M face images, Operation CameraSwarm hijacks 14,000 Dahua cameras, and GitLab flaw CVE-2026-19478 is exploited.
  26. Sakura Internet and CareCloud breaches, Dahua camera compromises, and the Cl0p PTC Windchill extortion campaign, plus actively exploited Windows IKE and GitLab …
  27. The CareCloud breach growing to 3.7M people, Medusa ransomware hitting 500+ US critical infrastructure orgs, and Clop's attack on PTC Windchill servers.
  28. Microsoft Azure account records sold, Pokémon Center and French tax data breaches, and critical Ray RCE actively exploited.
  29. Trezor customer data breach via ShipMonk, actively exploited VMware vCenter Syslog RCE, and Apple mercenary spyware alerts.
  30. Polish CHP plant hacked via private cellular APN, LexisNexis and Valve/CEVA breaches, and actively exploited Progress Kemp LoadMaster flaw.
  31. Metabase zero-day breaches customer data, Unlimited Technology Systems reports a 3.8M-person healthcare breach, and Claude Code and Gemini CLI flaws expose CI …
  32. WordPress wp2shell webshell attacks, Microsoft SharePoint RCE exploitation, and Anubis ransomware targeting Coca-Cola's Fairlife.
  33. Hugging Face breach by an autonomous AI agent, Estée Lauder and EY data breaches, and actively exploited ServiceNow and SonicWall zero-days.
  34. Hugging Face breach tied to an autonomous AI agent, SonicWall SMA 1000 zero-days giving root access, and WP2Shell WordPress flaws exploited in the wild.
  35. A 7-Zip RCE patch, public exploits for critical WordPress wp2shell flaws, and Microsoft's warning on surging ACR Stealer attacks.
  36. Abbott's Exact Sciences breach, WordPress Core critical RCE flaws, and SonicWall SMA zero-days exploited for root access by threat actors.
  37. ShareFile customers told to shut down storage controllers after an external threat; WP-SHELLSTORM backdoors thousands of WordPress sites; Zimbra critical flaw.
  38. Xsolis breach exposes 1.4M patients' health data, FortiBleed harvests 86,000 Fortinet credentials, and Squidbleed leaks proxy traffic.
  39. Gravity SMTP WordPress plugin flaw (CVE-2026-4020) exploited, Madison Square Garden breach claimed, Sapphire Sleet linked to Mastra npm supply chain attack.
  40. Klue integration breach exposes Salesforce data, FortiBleed credential theft hits ~86,000 Fortinet devices, and Operation Endgame disrupts SocGholish.
  41. Klue OAuth breach exposed Salesforce data, FortiBleed leaked ~74,000 Fortinet credentials, and law enforcement disrupted the SocGholish botnet.
  42. Kodak breach by ShinyHunters, iRhythm ransom theft, and three Fortinet FortiSandbox flaws actively exploited across up to 30,000 devices.
  43. ShinyHunters breaches at Council of Europe and Infinite Campus, Novo Nordisk and Tchap data theft, and exploited Cisco SD-WAN Manager flaw CVE-2026-20262.
  44. Infinite Campus school data theft by ShinyHunters, Tchap breach of French government accounts, and PAN-OS GlobalProtect exploitation.
  45. The Check Point VPN zero-day exploited by Qilin, the NSO Group WhatsApp spear-phishing campaign, and a SoFi subsidiary breach affecting customer data.
  46. Exploited Everest Forms Pro WordPress flaw (CVE-2026-3300), Meta AI bots abused to hijack Instagram accounts, and OpenAI's ChatGPT Lockdown Mode.
  47. ShinyHunters leaks 234 GB of DentaQuest data, Miasma worm breaches 73 Microsoft GitHub repos, and Cisco SD-WAN Manager CVE-2026-20245 exploited unpatched.
  48. Covers the IMA Diligence breach affecting 525,000 people, Acer Wave 7 mesh router zero-days, and a Microsoft 365 Android token-theft flaw.
  49. WeedHack malware infected 116,000+ Minecraft systems, Red Hat NPM packages hit by credential-stealing worm, and Gamaredon exploits WinRAR in Ukraine attacks.
  50. The Dashlane vault breach, the Miasma npm supply chain attack on Red Hat packages, and active exploitation of Windows Netlogon CVE-2026-41089 and Palo Alto …
  51. Dutch authorities dismantle a 17-million-device botnet; WP Maps Pro WordPress plugin flaw actively exploited to create rogue admin accounts.
  52. Grafana GitHub token breach, Canvas ransomware, and active WordPress Funnel Builder exploitation.
  53. Shai-Hulud worm source leak and TanStack supply chain breach at OpenAI, Exchange zero-day CVE-2026-42897, and JDownloader installer hijack.
  54. Foxconn ransomware by Nitrogen, OpenAI breach via TanStack supply chain attack, and Cisco SD-WAN zero-day CVE-2026-20182 exploited in the wild.
  55. The TeamPCP SAP npm supply chain attack, Checkmarx GitHub data theft, and a five-year dormant WordPress plugin backdoor affecting 70,000+ sites.
  56. Bitwarden and Checkmarx supply chain attacks, Vercel breach, and actively exploited Microsoft Defender BlueHammer zero-day.
  57. Ukrainian targeting by UAC-0247's AgingFly malware, a compromised WordPress EssentialPlugin package, and an nginx-ui flaw exploited in the wild …
  58. Eurail breach exposing 300,000+ passport records, ChipSoft ransomware shutdown, and Smart Slider 3 Pro backdoored update supply chain attack.
  59. Bitcoin Depot $3.6M crypto theft, Signature Healthcare hospital cyberattack, and TeamPCP supply chain breach exposing Cisco source code.
  60. APT28 router DNS hijacking stealing Microsoft 365 tokens, a SaaS integrator breach hitting a dozen-plus firms, and Flowise RCE flaw under active exploitation.
  61. ShinyHunters breach of Europa.eu, Handala hack of FBI director Kash Patel's email, and Fortinet FortiClient EMS flaw exploited in the wild.
  62. The Stryker Microsoft environment wiper attack, GlassWorm hitting Python repos, and Vidar delivered via hacked WordPress sites.
  63. The SocksEscort proxy botnet takedown, Telus Digital and Loblaw breaches, and Veeam's seven critical Backup & Replication flaws.
  64. The Stryker wiper attack by Handala, Michelin's Oracle EBS breach, critical n8n RCE flaws, and Microsoft's March Patch Tuesday fixes.
  65. The Wikipedia JavaScript worm, a $46M crypto theft arrest, LeakBase's takedown, and Cisco SD-WAN zero-days exploited in the wild.
  66. The Odido breach exposing 6.2M customers, Qilin's Conpet S.A. data theft, and BeyondTrust and Ivanti EPMM exploitation, plus threat actor and policy news.
  67. LastPass phishing aimed at master passwords, Google Gemini calendar prompt-injection leaks, and PDFSider malware sideloading.
  68. Grubhub and Central Maine Healthcare breaches, Microsoft-led RedVDS takedown, and a Cisco Secure Email Gateway zero-day exploited by China-linked APTs.
  69. Pear ransomware hits Tri-Century Eye Care; React2Shell and ICTBroadcast flaws exploited; malicious VS Code extensions found in Microsoft Marketplace.
  70. Cloudflare's record 29.7 Tbps Aisuru botnet DDoS, the Oracle E-Business Suite Clop campaign hitting universities, and WordPress King Addons plugin takeovers.
  71. ASUS router botnet Operation WrtHug, Cloudflare's six-hour outage, and Fortinet FortiWeb zero-days.
  72. The GlobalLogic Oracle EBS data theft, the Rhadamanthys infostealer takedown, and Microsoft's November 2025 Patch Tuesday with 63 flaws including a kernel …
  73. Covers SonicWall firewall config breach by state-sponsored actors, Balancer V2 $128M crypto theft, and actively exploited CentOS Web Panel RCE flaw from CISA.
  74. Miljödata breach affecting 1.5M, Nikkei Slack compromise and actively exploited Post SMTP WordPress flaw.
  75. Dentsu/Merkle breach, Canadian water and energy hacktivist intrusions, and DELMIA Apriso and XWiki exploitation, plus TEE.fail and PhantomRaven.
  76. Top Secret clearance database exposed, ChatGPT Atlas hidden-command flaw, and Chrome zero-day tied to Memento Labs spyware.
  77. AWS DNS outage, WSUS CVE-2025-59287 under active exploitation, and Lazarus Group fake job lures against European drone firms.
  78. F5 breach tied to Chinese actors, Prosper breach hitting 17.6M accounts, and Cisco IOS flaw exploited to deploy Linux rootkits.
  79. Discord Zendesk breach affecting 5.5M users, Qilin's Asahi brewery leak, and a LockBit-Qilin-DragonForce ransomware cartel.
  80. Red Hat GitLab repo breach claim, WestJet breach affecting 1.2M, and Oracle E-Business Suite extortion campaign possibly tied to Cl0p are the top stories.
  81. Salesloft Drift OAuth breach hits Cloudflare, Palo Alto Networks and Zscaler; Jaguar Land Rover cyberattack halts production; WhatsApp zero-day exploited …
  82. Nevada state government cyberattack shuts offices; Salesloft Drift token breach exposes Salesforce data; Citrix NetScaler zero-day CVE-2025-7775 patched.
  83. Columbia University breach hits 870,000, Bouygues discloses 6.4M-customer breach, and Royal/BlackSuit ransomware dismantled after 450+ U.S. victims.
  84. Akira ransomware exploiting SonicWall SSL VPN zero-days, the Pi-hole GiveWP breach, and Secret Blizzard AitM attacks on Moscow embassies.
  85. ShinyHunters vishing breaches at Qantas, Allianz Life and Adidas; SafePay claims 3.5TB Ingram Micro theft; Microsoft SharePoint mass exploitation hits South …
  86. The Toptal npm supply chain breach, Cisco ISE and PaperCut exploitation, and the BlackSuit-to-Chaos ransomware shift in one daily brief.
  87. Scattered Spider targets VMware ESXi hypervisors for ransomware; Tridium Niagara flaws expose smart buildings; Post SMTP WordPress plugin takeover bug.
  88. Allianz Life breach, WordPress Post SMTP flaw exposing 200k+ sites, and ToolShell SharePoint exploits.
  89. NNSA breach via Microsoft SharePoint zero-days, Clorox's $380M suit against Cognizant, and a backdoored npm 'is' package.
  90. Louis Vuitton and McDonald's data breaches, Gravity Forms WordPress plugin supply chain attack, and Gigabyte UEFI firmware flaws enabling Secure Boot bypass.
  91. The McHire chatbot data exposure of 64M applicants, the Gravity Forms supply-chain backdoor, and Wing FTP Server and FortiWeb exploitation.
  92. Qantas breach hits 6M customers, Cisco Unified CM hardcoded root SSH backdoor patched, and Gamaredon spearphishing Ukraine. Plus Scattered Spider and NimDoor.
  93. Paragon Graphite spyware hit journalists' iPhones, EchoLeak exposed Microsoft 365 Copilot, and 80,000 Entra ID accounts faced password spraying.
  94. Sensata and UNFI breaches, critical Roundcube RCE CVE-2025-49113 actively exploited, and a Wazuh flaw exploited by Mirai botnets.
  95. Critical WooCommerce Wishlist flaw puts 100k+ WordPress sites at risk; AyySSHush botnet hits 9,000 ASUS routers; Interlock ransomware targets universities.
  96. Cellcom outage cyberattack, SK Telecom malware breach exposing 27M USIM records, and RVTools supply chain attack delivering Bumblebee malware.
  97. Harrods cyberattack amid UK retail spree, Commvault zero-day CVE-2025-3928 breach, and NullBulge's Disney Slack data theft guilty plea.
  98. SonicWall SMA100 exploitation, Co-op cyberattack disruption and Ascension healthcare data breach.
  99. DOGE's alleged NLRB data exfiltration, a Microsoft Entra lockout mishap, and the 'Fog' ransomware campaign hitting over 100 victims since January.
  100. Japanese brokerage account breaches, 'Scallywag' WordPress plugin ad fraud, and an ASUS AiCloud router flaw (CVSS 9.2).
  101. GOFFEE attacks on Russian organizations, Gamaredon spear-phishing against Ukrainians, and OttoKit WordPress plugin flaw exploited within hours of disclosure.