Bleeping Computer

Compromised Admin Menu Editor Pro plugin updates introduced hidden admin account and backdoors compromising ~1,500 WordPress sites.

Attackers actively exploit critical WooCommerce Wholesale Lead Capture premium plugin to upload PHP backdoors and compromise WordPress sites.

Five alleged Black Axe leaders extradited to US to face wire fraud and money laundering charges tied to large-scale fraud operations.

CISA warns ransomware gangs are exploiting a critical VMware vCenter RCE to spread ransomware; patch vCenter immediately.

Cisco patched a critical Secure Email Gateway SQLi zero-day (CVE-2026-76461) that was actively exploited; immediate patching recommended.

Brevo compromise led to phishing emails targeting 347,000 Trezor-related addresses; 2,500 users clicked malicious links.

Dutch NCSC warns imminent exploitation of Check Point VPN flaws CVE-2026-85102 and CVE-2026-85103 allowing RCE.

Actors exploited Tencent Sogou Input Method CVE-2026-51990 to install GrayRabbit backdoor on Windows endpoints.

Trezor warns that a third-party email provider breach enabled phishing targeting wallet users to steal credentials and funds.

CISA warns WatchGuard Firebox RCE is being exploited by ransomware gangs to deploy encryptors and extort victims.

IDScan confirms breach linked to 153 million driver's license scans, raising large-scale identity and fraud risks.

BlueMoon exploit kit used by multiple espionage groups chains Chrome and Windows zero-days to gain remote code execution.

OpenAI's GPT-6 Astra can find zero-days autonomously, raising detection and monitoring challenges for security teams.

ShinyHunters claims to have breached Florida's DAVID DMV database, stealing over 200,000 driver records for extortion.

Threat actors adopt multi-agent AI frameworks to automate credential harvesting, scaling theft and account takeover operations quickly.

Adobe issued an emergency patch for the Magento zero-day 'StyleSmuggler' used to backdoor servers; immediate updates required for e-commerce.

Attackers use invisible Unicode characters (ASCII smuggling) in phishing emails to evade email security filters.

FalconFlank zero-day exploit targets CrowdStrike Falcon, enabling SYSTEM privilege escalation on updated Windows hosts.

Critical Citrix NetScaler authentication bypass CVE-2026-19490 is now being actively exploited in attacks.