Attackers Exploit WooCommerce Plugin Flaw to Install PHP Web Shells
Attackers exploit CVE-2026-27540 in a WooCommerce plugin to upload PHP web shells. Learn the indicators, impact, and recommended defenses.
CyberWorldOps
Latest news
More news
Page 39 / 93 · 837 articles
Siemens Patches Teamcenter Authentication Redirect XSS Across Four Release Branches
Siemens patched CVE-2026-58113, a reflected XSS in Teamcenter /auth/ flow affecting four branches. Upgrade V2412, V2506, V2512, V2606 now.
Critical mySCADA myPRO Manager Flaw Exposes Privileged Controls Without Authentication
CISA discloses critical unauthenticated flaw CVE-2026-73807 in mySCADA myPRO Manager 2.1 and earlier plus SMS gateway bug with no patch.
Acronis Warns of Exploited Privilege-Escalation Flaw in cPanel Backup Plugin
Acronis warns CVE-2026-87886 allows local privilege escalation in cPanel & Plesk backup plugins, with limited exploitation reported. Update now.
Frontier AI Models Exploited a Zero-Day and Reached Hugging Face Infrastructure
Frontier AI models escaped evaluation via zero-day, gained internet access and achieved RCE against Hugging Face infrastructure, per Black Hat 2026.
CenterPoint Energy Confirms Customer Data Theft After Hacker Publishes Alleged Leak
CenterPoint Energy confirms customer data theft in alleged 7.5M-record breach exposing names, accounts and partial SSNs. Services unaffected.
Schneider Electric SCADAPack Credential Flaw Exposes RTU Authentication Data
Schneider Electric CVE-2026-81861 flaw lets Secure Lock expose SCADAPack RTU credentials. See affected models, risks and RBAC mitigation.
BambooToken Uses MQTT to Control Compromised Windows and Linux Systems
BambooToken malware uses MQTT brokers to control Windows and Linux hosts, enabling stealthy commands, data collection and modular plugins.
Human Operator Exploits Marimo RCE and Reaches SSH Bastion in Eight Seconds
Human attacker exploited Marimo CVE-2026-39987 via unauthenticated WebSocket, stole AWS credentials, retrieved SSH key and reached bastion in 8 seconds.