cybersecurity3.9 min read
Unauthenticated WordPress core flaw forces urgent updates across 6.9/7.0 lines
2 days ago•Source: The Hacker News
Cybersecurity News
The latest cybersecurity stories, summarized by AI
Featured Cybersecurity Stories
View original source
3.345 min•4 days ago
Gold Eagle Initiative Creates AI Patch Clearinghouse for Cybersecurity
The White House launched the Gold Eagle AI cybersecurity clearinghouse to help federal agencies, critical infrastructure operators, and AI developers identify and patch software vulnerabilities uncovered by advanced AI models, in line with a June executive order on AI security. The multi‑sector effort will involve industry partners and open‑source developers, use frontier models like Mythos, and serves as the administration’s first major test of voluntary AI-security directives.
More Top Stories
2
Phony AAA Email Scam Tricks Drivers With Bogus Federal Rule
Fox News•28 days ago
3
Chrome 0-Day in the Wild Dominates a Week of Exploits, Phishing, and Malware
The Hacker News•1 month ago
More Cybersecurity Stories
Microsoft’s Digital Crimes Unit at Center of Z-day Disclosure Controversy
Microsoft is facing backlash from security researchers after signaling that its Digital Crimes Unit will pursue cases against individuals who publicly disclose Windows zero-day vulnerabilities, arguing such disclosures endanger customers. The controversy centers on Nightmare Eclipse’s six disclosed exploits; Microsoft contends coordinated disclosure is essential, while critics warn the stance could chill research and highlight First Amendment and CFAA debates. The piece situates the dispute within broader tensions over vulnerability disclosure, state-backed hacking, and how security researchers should responsibly report flaws.
Defender for Endpoint Tests Auto-Isolation to Stop Lateral Movement
Microsoft Defender for Endpoint is previewing automatic isolation as part of Automatic Attack Disruption, automatically isolating suspected-compromised onboarded endpoints to limit attacker lateral movement and data exfiltration while keeping the device monitored; security operators can release the device after investigation, with the feature expanding prior isolation capabilities across Windows and Linux devices and user accounts.
FBI Warns Kali365 PhaaS Bypasses MFA on Microsoft 365
The FBI issued a PSA about Kali365, a phishing‑as‑a‑service that exploits Microsoft’s OAuth device-code flow to hijack Entra and Microsoft 365 accounts, stealing session tokens and bypassing MFA. Kali365, distributed via Telegram, provides AI‑generated phishing lures, automated campaigns, and real‑time dashboards, with two attack modes: device‑code phishing and a Cookie Link adversary‑in‑the‑middle. Arctic Wolf observed global campaigns targeting Microsoft 365 environments, including creating malicious inbox rules and registering new devices. The FBI urges blocking device‑code authentication with Conditional Access, auditing usage, reporting incidents to IC3, and preserving phishing emails and suspicious activity. Device-code phishing has surged in 2026, with other PhaaS tools like EvilTokens and Tycoon2FA using similar methods.
Massive Laravel-Lang Breach Sparks Cross-Platform Credential Theft
Security researchers warn of a broad compromise of Laravel-Lang PHP packages (laravel-lang/lang, http-statuses, attributes, actions) that injected a malicious src/helpers.php into autoloaded vendor files. The attack involved rapid tagging of 700+ package versions in May 2026, suggesting access to the Laravel Lang release infrastructure. The embedded dropper runs on startup and delivers a ~5,900-line PHP credential stealer that exfiltrates cloud tokens, service credentials, browser data, VPN configs and more to flipboxstudio.info, encrypts results with AES-256, and self-deletes. Windows uses a Visual Basic Script launcher; Linux/macOS execute the payload via shell. Remediation includes auditing dependencies, rotating credentials, upgrading to clean versions, and monitoring for indicators of compromise.
AI Flags 10,000+ Critical Flaws, Accelerating Patch Push Worldwide
Anthropic’s Project Glasswing, using Claude Mythos Preview, has identified more than 10,000 high- or critical-severity software vulnerabilities since launch, including 6,202 affecting over 1,000 open-source projects; 1,726 confirmed true positives and 1,094 high/critical. The effort has yielded 97 upstream patches and 88 advisories, with examples like WolfSSL CVE-2026-5194 (CVSS 9.1). The work underscores the gap between discovery and remediation, while defenders credit the tool for preventing fraud (a partner bank blocked a $1.5M wire transfer). Anthropic also launched a Cyber Verification Program for legitimate testing; public, unrestricted access to Mythos-like models remains unlikely amid safeguards. The episode amplifies calls to shorten patch cycles and harden defenses across software supply chains.
Global raid shuts down ransomware-linked VPN First VPN and seizes its infrastructure
An international operation led by France and the Netherlands, with Europol/Eurojust support, dismantled the ‘First VPN’ service used by ransomware and data-theft actors. Authorities seized 33 servers across 27 countries, shut down key domains, disrupted infrastructure, and arrested the administrator in Ukraine. Investigators infiltrated the VPN to recover data, with Europol reporting 506 identified users and 83 intelligence packages shared to aid ongoing investigations into ransomware and related crimes. While VPNs have legitimate uses, criminals leveraged this service to hide activity; all identified users have been notified and further legal action may follow.
PoC Unleashes PinTheft Linux LPE, Unlocks Root Access
A proof-of-concept exploit named PinTheft has been published for a Linux kernel local privilege escalation, leveraging an RDS zerocopy double-free flaw to gain root access under specific kernel configurations. The PoC demonstrates a novel way to steal references via io_uring and overwrite in-memory pages, underscoring ongoing Linux kernel security challenges. Admins should apply latest patches or blacklist vulnerable modules to mitigate risk.
Millions at Risk as NGINX Zero-Day RCE Flaw Sees Real-World Exploitation
Security researchers say CVE-2026-42945, a heap buffer overflow in NGINX Open Source and NGINX Plus, is being actively exploited in the wild. The flaw can crash NGINX worker processes via crafted requests, with remote code execution possible only if ASLR is disabled and a specific rewrite configuration is present; despite ASLR generally enabled, estimates show up to 5.7 million internet-facing servers may be affected. Organizations should patch promptly, ensure ASLR remains enabled, and audit rewrite rules to mitigate risk while threat actors rapidly scan for vulnerable systems.
Week in Security: Exchange Zero-Day Exploited, NPM Worm Surges, and AI Supply-Chain Risks
This weekly security roundup highlights rapid, multi-vector threats: on-prem Microsoft Exchange is being exploited via CVE-2026-42897 (spoofing/XSS), Cisco’s SD-WAN Controller faces active exploitation from CVE-2026-20182, and a TeamPCP‑driven wave poisons TanStack npm packages as part of a larger supply-chain campaign. The era of fake AI repos delivering stealer malware continues (Open-OSS/privacy-filter on Hugging Face). AI-assisted vulnerability discovery is accelerating with OpenAI’s Daybreak and Microsoft MDASH, alongside other notable findings (ransomware deals, new CVEs, and cross‑platform E2EE deployments). The takeaway: patch early, rotate keys, and assume software supply chains are compromised.
Admin Access Wipeout: Burst Statistics Plugin Flaw Exposes WordPress to Takeover
A critical vulnerability in the Burst Statistics WordPress plugin (versions 3.4.0–3.4.1.1, CVE-2026-8181) allows unauthenticated attackers to bypass authentication and impersonate an administrator via crafted REST API requests, potentially creating a new admin account and taking over a site. Discovered May 8, 2026 by Wordfence’s PRISM, it was patched in version 3.4.2 on May 12, 2026. The flaw stems from improper handling of authentication in the MainWP integration, enabling exploitation across REST endpoints. admins should immediate patch to 3.4.2+, audit user accounts, and monitor logs to prevent compromise.