WordPress fixes CVE-2026-64638, a pre-auth login XSS affecting every version, with a demonstrated path to PHP execution under ...

BdThemes supply chain attack poisons JSON feed to create rogue WordPress admins and deploy web shells without code changes.

Researchers discovered hackers-for-hire performing cyber espionage and financially motivated heists from the same Web panel.

The WordPress developers have closed a malicious code security vulnerability known as XSS2Shell. In a detailed blog post, a security researcher from pwn.ai explains details about the XSS2Shell ...

BdThemes' compromised JSON feed exploits XSS in seven WordPress plugins, creating rogue admins and installing a PHP web shell without plugin updates.

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create ...

Microsoft 365 phishing campaign disclosed by Arctic Wolf Labs abuses Google Meet and Amazon S3 to bypass enterprise email ...