Latest headlines from security outlets
Collected every two hours from specialised publications — each link leads to the original article.
Fedora 43 WordPress 6.9.9 Security Advisory RCE CVE-2026-87902
WordPress 6.9.9 Security Release Security updates included in this release Unauthenticated path traversal in page-template resolution leading to conditional RC…
Fedora WordPress Critical Path Traversal RCE Vuln 2026-7f9c69a63c
WordPress 6.9.9 Security Release Security updates included in this release Unauthenticated path traversal in page-template resolution leading to conditional RC…
Debian WordPress Remote Code Execution and Escalation Flaw DSA-6525-1
Several vulnerabilities were discovered in wordpress, a web blogging tool, which could result in cross-site scripting, privilege escalation or remote code exec…
Critical Remote Code Execution Vulnerability in Fedora WordPress 6.9.7
Fedora has released WordPress version 6.9.7, addressing multiple security vulnerabilities, including remote code execution and stored cross-site scripting issu…
Fedora 43 WordPress 6.9.7 Authenticated RCE Update 2026-61704c09ea
Fedora released WordPress version 6.9.7, addressing multiple security vulnerabilities, including remote code execution, various XSS issues, privilege escalatio…
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malwar…
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to ach…
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems (CMS) p…
Fedora 43 Wordpress Critical SQL Injection RCE Vuln 2026-46346e9637
Fedora 43 has released WordPress version 6.9.5, addressing security vulnerabilities including SQL injection and remote code execution issues. Users can update …
wp2shell: WordPress Patches a Pre-Auth RCE That Needed No Plugins
WordPress 6.9.5 and 7.0.2 fix wp2shell, a core REST API bug chaining route confusion and SQL injection into unauthenticated remote code execution.wp2shell: Wor…
Debian WordPress Critical SQL Injection Threat DSA-6399-1 CVE-2026-60137
A SQL injection vulnerability was found in WordPress, prompting an important update to version 6.8.6+dfsg1-0+deb13u1 for the stable Debian distribution.
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors managed to tamper with the official release …
Fedora 42 WordPress 6.9.4 Notification 2026-675dd9b166 Unauthorized Access
Upstream announcements: WordPress 6.9.2 Release WordPress 6.9.3 and 7.0 beta 4 WordPress 6.9.4 Release
Fedora 43 Wordpress 6.9.4 Important REST API Access Issue 2026-5774d46593
Upstream announcements: WordPress 6.9.2 Release WordPress 6.9.3 and 7.0 beta 4 WordPress 6.9.4 Release
Debian Trixie WordPress Security Advisory DSA-6091-1 for CVE-2025-58246
Multiple security issues were discovered in the WordPress blogging tool, which could result in cross-site scripting or information disclosure. For the stable d…
Debian: WordPress Important XSS and Info Disclosure DSA-6075-1
Multiple security issues were discovered in the WordPress blogging tool, which could result in cross-site scripting or information disclosure. For the oldstabl…
WordPress King Addons Flaw Under Active Attack Lets Hackers Make Admin Accounts
A critical security flaw impacting a WordPress plugin known as King Addons for Elementor has come under active exploitation in the wild.The vulnerability, CVE-…
Debian 11: WordPress Critical XSS Issues DLA-4358-1 CVE-2024-6307
Several security vulnerabilities have been discovered in Wordpress, a popular content management framework. CVE-2024-6307
Hackers Abuse Blockchain Smart Contracts to Spread Malware via Infected WordPress Sites
A financially motivated threat actor codenamed UNC5142 has been observed abusing blockchain smart contracts as a way to facilitate the distribution of informat…
Fedora 41: WordPress 6.8.3 Critical Data Leak & XSS Vulnerability Alert
WordPress 6.8.3 Release Security updates included in this release: A data exposure issue where authenticated users could access some restricted content. Indepe…
ShadowCaptcha Exploits WordPress Sites to Spread Ransomware, Info Stealers, and Crypto Miners
A new large-scale campaign has been observed exploiting over 100 compromised WordPress sites to direct site visitors to fake CAPTCHA verification pages that em…
Post SMTP Plugin Flaw Risked 400K+ WordPress Sites To Hijacking
WordPress admins need to update their websites with the latest Post SMTP plugin release, as…Post SMTP Plugin Flaw Risked 400K+ WordPress Sites To Hijacking on …
Linux Foundation Announces FAIR Package Manager for WordPress Stability
Alright, Linux admins and security pros, let's talk WordPress . I know''typically, "WordPress" doesn't top the list of thrilling topics in our corner of the te…
Over 100,000 WordPress Sites at Risk from Critical CVSS 10.0 Vulnerability in Wishlist Plugin
Cybersecurity researchers have disclosed a critical unpatched security flaw impacting TI WooCommerce Wishlist plugin for WordPress that could be exploited by u…