CyberXero Uses AI Agent Swarms to Scale WordPress Intrusions and Target Ukrainian Energy
A Russian-speaking initial-access broker known as CyberXero used dozens of AI agents alongside PentAGI and Cobalt Strike to automate web attacks and conduct targeted reconnaissance. Exposed operator files...
Leaked Control Panel Exposes 50,000 Stolen Credentials Harvested From WordPress Backups
Researchers at LevelBlue uncovered TIKTOUK, a credential-harvesting toolkit that scans for exposed WordPress backups, configuration files, and JavaScript secrets. A leaked operator panel contained roughly 50,000 real credentials...
Suspected Chinese-Speaking Hackers Chain Two WordPress Bugs to Loot a Government Database
A likely Chinese-speaking threat actor strung together two WordPress vulnerabilities to breach at least 49 organizations in 29 countries, with one Western government agency losing 18,566 records, including...
wp2shell: The WordPress Core Bug That Lets Anyone Take Over 500 Million Sites Without Logging In
A newly disclosed WordPress Core vulnerability, nicknamed wp2shell, chains a REST API batch-route flaw into full unauthenticated remote code execution. No plugins, no login, and no special configuration...
Smart Slider 3 Pro Plugin Backdoored via Supply Chain Attack — 800,000+ Sites at Risk
Threat actors compromised the update infrastructure of Nextend, the vendor behind Smart Slider 3 Pro, and pushed a fully backdoored plugin version to hundreds of thousands of WordPress...