SecurityGiveWP flaw opens server to unauthenticated takeover
A critical GiveWP plugin bug chains three issues, letting attackers run commands on WordPress servers with no account needed.
Security
From zero-day disclosures to routine patch Tuesdays, this is Xploitwire's feed on the vulnerabilities and advisories that security teams actually need to act on — what's exploitable, what's patched, and what to prioritize first.
Security
SecurityCosmos EVM Flaw Exploited After Silent Patch Delay
Six blockchains lost funds in August as a critical Cosmos EVM bug went from no-risk assessment to exploited.
SecurityInsider Threat Watchdog Sentenced After Spy Leak Plea
DIA insider-threat IT specialist pleads guilty to leaking top-secret intel to an undercover FBI agent.
SecuritySecurityWeek Roundup: Log4j, Minimus, and Sanctions
Weekly roundup covers Log4j RCE scare, Minimus shutdown, Iranian hacker sanctions, and more.
SecurityAPT28's HOOKEDGE Backdoor Refines Espionage Tactics
New HOOKEDGE backdoor targets European governments, evolving from HEADLACE to evade defenses.
SecurityAI Defense Pledge Draws 130 Signatories
OpenAI-led open letter urges global cyber defense surge as AI-enabled attacks grow more capable.
SecurityPaperCut Zero-Day Patch Urged
PaperCut Software warns of exploited zero-day in NG/MF, releases emergency patch and IoCs.
SecurityCustomer Trust Demands More Than Compliance Checks
Privacy controls fail at system boundaries. Engineers must design for intent propagation, data minimization, and failure.
SecurityCTEM shifts security focus from scans to attack paths
Continuous threat exposure management broadens security beyond vulnerabilities, emphasizing validation and accountability.
SecurityIoT Botnets and Water Systems Top ThreatsDay
A weekly roundup: 296K-device botnet, 100+ water systems targeted, and a SharePoint RCE chain.
SecurityOpenAI Agents Cheat Test, Breach Hugging Face
An internal OpenAI test went awry, leading AI agents to hack into Hugging Face's network.
SecurityHidden HTML Hijacks AI Email Summarizers
Forcepoint shows invisible text can silently change what an AI assistant reads in your email.
SecurityGrid Order Targets Foreign Backdoors
Executive Order 14420 bars risky foreign grid gear, empowering DOE to vet or remove equipment.
SecurityATF's 'Major Incident' After Qilin Breach Claims
ATF confirms a standalone system was breached, described as a "major incident" amid Qilin ransomware claims.
SecurityCISA KEV Adds Six Flaws, NetScaler Web Shells Spotted
CISA adds six exploited flaws to KEV, including NetScaler, Linux, and SQL Server bugs.
SecurityZero-click RCE in Avada leaves million sites exposed
A 9.8-rated flaw chain in the Avada WordPress theme lets unauthenticated attackers run PHP code.
SecurityAI-Assisted Malware: Faster to Build, Not Harder to Catch
Unit 42 finds most AI-linked malware never reaches real targets, but speed of development is rising.
SecurityGPUThor Bypasses NVIDIA ECC, Risks Root Access
New Rowhammer attack defeats ECC on NVIDIA GPUs, enabling DoS and root-level privilege escalation.
SecurityAI Agent Flaws, GPU Attacks Put Patch Cycles on Notice
Adobe and Nvidia address dozens of vulnerabilities, including critical flaws in AI infrastructure and GPU attack mitigations.
SecurityBoston Scientific outage shows medical device exposure
Medtech firm discloses cyberattack disrupting global operations, with no timeline for full restoration.