News Archives

Attackers Abuse Gravity SMTP WordPress Flaw to Harvest API Keys

A vulnerability in the Gravity SMTP WordPress plugin allowed unauthenticated actors to extract API keys and configuration data from roughly 100,000 sites. A fix is available in version 2.1.5; site owners should update and rotate credentials.

June 21, 2026

Operation Endgame Shuts Down SocGholish Infrastructure and Cleans Nearly 15,000 WordPress Sites

International police actions under Operation Endgame disrupted SocGholish infrastructure, seizing 106 servers and cleaning 14,971 WordPress sites. This piece summarizes the takedown, how SocGholish operates, affected countries, and mitigation advice for site owners.

June 19, 2026

Novice Intruder Used OpenSSH and Tailscale to Maintain Access After C2 Went Dark

A novice intruder used OpenSSH and Tailscale to preserve access to a small French car shop after his Havoc C2 went offline. Cato Networks captured 339 commands and a playbook left in a public bucket, revealing how a separate VPN-based backdoor survived a takedown.

June 18, 2026

CISA Adds LiteSpeed cPanel Plugin Flaw to KEV; Risk of Root Privilege Escalation

CISA has listed a high-severity LiteSpeed cPanel Plugin vulnerability (CVE-2026-54420) in its KEV catalog. The flaw can let FTP or web-shell users on CloudLinux/CageFS shared hosts escalate to root. Agencies must remediate by June 18, 2026; updates and detection steps are provided.

June 16, 2026

One-Click Flaw in Microsoft 365 Copilot Could Have Exposed Emails, Files, and MFA Codes

Researchers at Varonis chained three bugs in Microsoft 365 Copilot Enterprise Search into a one-click exfiltration method called SearchLeak that could have exposed emails, files, and MFA codes. Microsoft has mitigated the issue (CVE-2026-42824) on its backend; Varonis published a proof-of-concept but did not see active exploitation.

June 15, 2026

Trusted JS for Popular WordPress Plugins Altered to Drop Hidden Backdoors

Trusted JavaScript files used by PushEngage, OptinMonster and TrustPulse were altered to install concealed backdoors that can hand attackers administrator access to WordPress sites. Here’s what happened, who was affected, and how to check and recover.

June 14, 2026