Tag: Web Security
Attackers posed as 32 AI bots to hunt for secret files
Cequence caught one actor cycling through fabricated OpenAI, Anthropic and Meta user agents against roughly 90 credential paths.
Nearly a thousand Magento storefronts still carry a visitor-skimming loader
Sansec has counted 953 infected online stores, most on Magento, in a campaign running since July 2025 that swaps loader…
Stolen UpdraftCentral keys became a WordPress plugin factory
Remote-management credentials lifted from TeamUpdraft let attackers push malicious plugins onto connected sites, and revoking the key does not undo…
Let’s Encrypt will cut default certificate life to 64 days
The shorter lifetime starts February 10, 2027, and it is a rehearsal for 45-day certificates in 2028.
This WordPress backdoor regrows from any surviving copy
Sucuri's SC backdoor hides in eight places and rebuilds itself from any one that survives cleanup.
One click on a crafted link can seize an Elementor site
A CSRF flaw in the Elementor website builder lets a single link create a rogue administrator account on millions of…
WordPress core patch closes a path traversal that can run code
WordPress 7.1.2 closes a path traversal in get_page_template() that needs no account and can end in code execution on some…
One link is enough to force a theme onto WordPress
WordPress 7.1.1 fixes a chain that installs a theme from the official directory from a single crafted link.