pwnspectrum

Threat actors are exploiting a critical vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture plugin. This flaw permits unauthenticated attackers to upload malicious PHP files, potentially compromising the entire WordPress site. Users of WooCommerce must update the plugin and apply network-level restrictions on file uploads.

A pre-authentication Remote Code Execution (RCE) vulnerability was exploited in Marimo, allowing attackers to rapidly harvest AWS credentials. The attacker then pivoted to retrieve keys and access a bastion host. Systems using Marimo must apply security patches and assume credentials stored in secrets managers are compromised.

A mass-scanning campaign is targeting internet-exposed Vite development servers to extract cloud credentials and configurations from AWS. Organizations deploying Vite-based frontends should secure these development servers, restrict internet access, and review IAM roles.

The ClickFix campaign utilizes compromised WordPress sites, installing Deno to deliver a Python-based infostealer. Users of WordPress should implement strong content security policies (CSP) and use robust filtering to prevent malicious script execution.

Iranian-affiliated threat actors are exploiting Programmable Logic Controllers (PLCs) across U.S. critical infrastructure. These attacks threaten operational technology (OT) environments. Defenders must implement strict network segmentation between IT and OT networks and monitor ICS traffic for anomalies.

Four espionage groups were observed utilizing the BlueMoon exploit kit to exploit recently patched flaws in Chrome and Windows. This highlights the danger of 'patch lag' and the need for continuous monitoring. Organizations must maintain rigorous patch management across all endpoints.

Threat actors are increasingly targeting AI assets and underlying models to operationalize their use. Security measures must evolve to protect data pipelines, training models, and API endpoints. Review API access controls and implement Model Drift Detection (MDD).

This reconstruction details a major incident involving OpenAI and Hugging Face, emphasizing the unique risks in the AI supply chain. The incident demonstrated that merely setting up rules is insufficient; strong, auditable technical controls are required to govern AI usage.

Postmortems on AI incidents confirm that policy rules and internal guidelines alone do not provide adequate security. Strong technical controls—including granular access controls, input validation, and continuous monitoring—must be implemented to secure LLM deployments.

Sophos advises utilizing comprehensive security services, including MDR and dedicated threat intelligence, for Microsoft environments. This serves as a reminder for organizations to adopt layered defense strategies rather than relying on single product solutions.

Concrete CMS 9 versions (9.0.0 through 9.5.2) lack proper authorization checks on the user selector autocomplete endpoint. This flaw permits unauthorized access to user data or functionality. Affected systems must upgrade immediately or implement strict access control measures.

Before version 2.6.0, Vikunja allows an attacker with a valid access token to read the raw TOTP shared secret via specific API endpoints. This bypasses standard re-authentication requirements and mandates an immediate upgrade to the latest version.

A critical vulnerability was identified in GitLab that could allow an attacker to compromise CI/CD server functionality. Exposure of the build system represents a high-value target for attackers. Teams must isolate CI/CD runners and apply all pending GitLab security patches.

CISA published findings from an incident response engagement at a U.S. federal civilian executive branch. This provides practical lessons on threat detection and incident handling in high-value government environments. Organizations should review their own IR plans based on these findings.