ALL POSTS

Key Findings Anonymous HTTP requests can execute code on WordPress sites running core versions 6.9 through 7.0.1 without any plugins or authentication Two chained vulnerabilities, now assigned CVE-2026-63030 and CVE-2026-60137, combine a REST API batch-route confusion with SQL injection to bypass all protections WordPress patched the issue Friday with forced auto-updates to versions 6.9.5 and 7.0.2, but sites with auto-updates disabled remain vulnerable Full technical details

Key Findings CrowdStrike disclosed CVE-2026-40050, a critical unauthenticated path traversal vulnerability in LogScale self-hosted The flaw allows remote attackers to read arbitrary files from server filesystems without authentication Next-Gen SIEM and LogScale SaaS customers are not affected due to network-layer mitigations applied April 7, 2026 Self-hosted LogScale customers must urgently upgrade to patched versions No known active exploitation has occurred to date The vuln

Key Findings Researchers at Mandiant Threat Defense, part of Google Cloud Security Operations, have revealed a critical unauthenticated access vulnerability in Gladinet's Triofox file-sharing platform (CVE-2025-12480). The vulnerability allowed attackers to bypass authentication, create administrative accounts, and achieve SYSTEM-level code execution through a chained attack path. The exploitation campaign was first detected on August 24, 2025, when Google Threat Intelligence