A malicious WordPress plugin named 'Modern Recent Posts' has been discovered, targeting administrators with fake browser update pop-ups. The plugin injects malicious JavaScript from an external domain, only affecting logged-in administrators on Windows machines. The campaign uses social engineering tactics to trick users into downloading potential malware. The plugin includes persistence mechanisms and can self-update. This sophisticated attack demonstrates a focused approach on high-value targets, leveraging trust in security updates to compromise local machines. The malware's stealthy nature and targeted delivery system make it particularly dangerous for WordPress site owners.
I&#;x26;#;39;m always looking for new ways of manipulating the data captured by my DShield sensor [1]. This time I used Gephi [2] and Graphiz [3] a popular and powerful tool for visualizing and exploring relationships between nodes, to examine the relationship between the source IP, filename and which sensor got a copy of the file. I queried the past 30 days of data stored in my ELK [4] database in Kibana using ES|QL [5][6] to query and export the data and import the result into Gephi. 
CVE-2025-61546 is a critical vulnerability in edu Business Solutions Print Shop Pro WebDesk version 18.34 that allows remote attackers to manipulate financial transactions by submitting negative quantities when purchasing items. This flaw exists because the application relies solely on client-side input validation, which can be bypassed, enabling attackers to create financial discrepancies. The vulnerability is exploitable without authentication or user interaction, with a CVSS score of 9.1 indicating high impact on confidentiality and integrity. It was fixed in version 19.69. European organizations using affected versions risk financial fraud and data integrity issues. Mitigation requires upgrading to the patched version and implementing robust server-side input validation. Countries with significant adoption of edu Business Solutions products and strong print service sectors, such as Germany, France, and the UK, are most likely to be impacted.
CVE-2026-0669 is a high-severity path traversal vulnerability in the CSS extension of Wikimedia Foundation's MediaWiki versions 1.39, 1.43, and 1.44. This flaw allows an unauthenticated remote attacker to read arbitrary files on the server by manipulating file path inputs, bypassing directory restrictions. The vulnerability impacts confidentiality but does not affect integrity or availability. No user interaction or privileges are required for exploitation, and no known exploits are currently reported in the wild. European organizations using affected MediaWiki versions, especially those hosting sensitive or proprietary information, face significant data exposure risks. Mitigation requires promptly updating to patched versions once available or applying strict input validation and access controls on the CSS extension. Countries with high MediaWiki adoption in government, education, and public sectors—such as Germany, France, the UK, and the Netherlands—are most at risk.
CVE-2026-0668 is a medium-severity vulnerability in the Wikimedia Foundation's MediaWiki VisualData Extension version 1.45. It involves inefficient regular expression complexity, leading to a potential Regular Expression Denial of Service (ReDoS) attack. This vulnerability can be exploited remotely without authentication or user interaction, causing service disruption by exhausting server resources. No known exploits are currently reported in the wild. The impact is limited to availability, with no confidentiality or integrity compromise. European organizations running affected MediaWiki versions with the VisualData extension are at risk of service degradation or downtime. Mitigation requires patching or applying workarounds to limit or optimize regex processing. Countries with significant Wikimedia usage and MediaWiki deployments, such as Germany, France, and the UK, are most likely affected. The vulnerability's CVSS score is 5.
CVE-2026-22541 is a high-severity vulnerability affecting EFACEC QC 60/90/120 electric vehicle chargers. It involves uncontrolled resource consumption (CWE-400) triggered by a massive flood of ICMP requests targeting a critical control board within the charger. This denial of service (DoS) condition disrupts the board's operation, which is essential for managing EV interfaces, thereby rendering the charger non-functional. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently reported in the wild, the ease of exploitation and potential impact on EV charging infrastructure make this a significant threat. European organizations operating EFACEC chargers, especially in countries with high EV adoption and EFACEC market presence, are at risk. Mitigation involves network-level filtering of ICMP traffic, segmentation of EV charger management networks, and close collaboration with EFACEC for firmware updates once available. Countries like Portugal, Germany, France, and the Netherlands are likely most affected due to EFACEC's market footprint and EV infrastructure density.
Impersonating a legitimate extension from AITOPIA, the two malicious extensions were also exfiltrating users’ browser activity. The post Chrome Extensions With 900,000 Downloads Caught Stealing AI Chats appeared first on SecurityWeek .
Key takeaways Introduction GoBruteforcer is a botnet that turns compromised Linux servers into scanning and password brute-force nodes. It targets internet-exposed services such as phpMyAdmin web panels, MySQL and PostgreSQL databases, and FTP servers. Infected hosts are incorporated into the botnet and accept remote operator commands.  Newly discovered weak credentials are used to steal data, […] The post Inside GoBruteforcer: AI-Generated Server Defaults, Weak Passwords, and Crypto-Focused Campaigns appeared first on Check Point Research .
The critical-severity vulnerability allows unauthenticated, remote attackers to execute arbitrary shell commands. The post Hackers Exploit Zero-Day in Discontinued D-Link Devices appeared first on SecurityWeek .
Threat actors are leveraging complex routing scenarios and misconfigured spoof protections to send phishing emails that appear to be internal communications. These attacks, which have increased since May 2025, use various lures like voicemails, shared documents, and password resets to conduct credential phishing and financial scams. The campaigns, often using PhaaS platforms like Tycoon2FA, are opportunistic and target multiple industries. While Microsoft detects most attempts, organizations can further mitigate risks by properly configuring spoof protections and third-party connectors. The attacks do not affect customers whose Microsoft Exchange MX records point to Office 365, as they are protected by built-in spoofing detections.
Threat actors spoof legitimate domains to make their phishing emails appear to have been sent internally. The post Complex Routing, Misconfigurations Exploited for Domain Spoofing in Phishing Attacks appeared first on SecurityWeek .
Malicious use of QR codes has long been ubiquitous, both in the real world as well as in electronic communication. This is hardly surprising given that a scan of a QR code can lead one to a phishing page as easily as clicking a link in an e-mail.
CVE-2025-14804 is a high-severity vulnerability in the Frontend File Manager WordPress plugin prior to version 23.5. It allows any authenticated user, including low-privilege roles like subscribers, to delete arbitrary files on the server due to improper validation of a path parameter and file ownership. The vulnerability does not require user interaction and can be exploited remotely over the network. While it does not impact confidentiality or availability, it severely impacts integrity by enabling unauthorized file deletion. No known exploits are currently reported in the wild. European organizations using this plugin on WordPress sites are at risk, especially those with subscriber-level users. Mitigation requires immediate updating to version 23.5 or later and restricting plugin access to trusted users only. Countries with high WordPress usage and significant e-commerce or media sectors, such as Germany, France, and the UK, are most likely affected.
CVE-2025-61492 is a critical command injection vulnerability in the execute_command function of terminal-controller-mcp version 0.1.7. It allows unauthenticated attackers to execute arbitrary system commands remotely without any user interaction. The vulnerability has a CVSS score of 10, indicating maximum severity with full impact on confidentiality, integrity, and availability. No patches are currently available, and no known exploits have been reported in the wild yet. This flaw stems from improper input validation leading to command injection (CWE-77). European organizations using terminal-controller-mcp or related systems are at high risk, especially those in sectors relying on this software for terminal management. Immediate mitigation involves restricting network access to the vulnerable service, implementing strict input validation, and monitoring for suspicious command execution attempts. Countries with significant IT infrastructure and industrial control deployments, such as Germany, France, and the UK, are most likely to be affected.
Using fake accounts and synthetic data to lure the hackers, the researchers gathered information on their servers. The post Researchers Trap Scattered Lapsus$ Hunters in Honeypot appeared first on SecurityWeek .
Fake Booking reservation cancellations and fake BSODs trick victims into executing malicious code leading to RAT infections. The post Sophisticated ClickFix Campaign Targeting Hospitality Sector appeared first on SecurityWeek .
The initial access broker (IAB) relies on credentials exfiltrated using information stealers to hack organizations. The post Dozens of Major Data Breaches Linked to Single Threat Actor appeared first on SecurityWeek .
The VPN company has conducted an investigation after a threat actor claimed to have hacked its systems. The post NordVPN Denies Breach After Hacker Leaks Data appeared first on SecurityWeek .
