Backuply WordPress Plugin SQL Injection Enables Site Takeover
October 16, 2026
Wordfence disclosed CVE-2026-93953, a SQL injection in the Backuply WordPress plugin, with 600,000 installs, that can lead to rogue administrator
News
Backuply WordPress Plugin SQL Injection Enables Site Takeover
Wordfence disclosed CVE-2026-93953, a SQL injection in the Backuply WordPress plugin, with 600,000 installs, that can lead to rogue administrator accounts.
Aoki Infostealer Now Steals API Keys From AI Coding Assistants
Symantec reports new Aoki infostealer variants that take credentials and session files from Claude, Codex, Cursor, Gemini, Copilot and AWS to enable LLMjacking.
X Removes 13,000 Accounts Tied to Foreign Influence Operations
X says it removed more than 13,000 accounts in three suspected foreign influence operations linked to Iran, Russia and China, ahead of the US midterm ...
GreyNoise: Proxyjacking Campaign Hijacks D-Link, Ubiquiti Devices
GreyNoise found a proxyjacking campaign that compromised at least 143 edge devices in 34 countries, installing Pawns.app to resell victims' bandwidth.
GhostBat Android RAT Targets 60 Indian Banking and UPI Apps
Cyble describes an updated GhostBat Android RAT that uses a Ghost Overlay to steal UPI PINs from 60 Indian financial apps via fake traffic fine ...
Cisco Secure Email Gateway Zero-Day CVE-2026-76519 Exploited
Cisco confirms attackers are exploiting CVE-2026-76519, a CVSS 9.8 Secure Email Gateway flaw that gives root access, the second such zero-day since September.
Palo Alto Patches PAN-OS RCE Zero-Day CVE-2026-0322 Under Attack
Palo Alto Networks patched CVE-2026-0322, a PAN-OS management interface RCE giving root access that is under limited exploitation, and CISA added it to KEV.
Microsoft Seizes Domains of Chinese Phishing Kits Behind 1B Messages
Microsoft, Health-ISAC and partners seized domains tied to the CoGUI, Haozi and Iron Man phishing kits and YAM Store, linked to over a billion scam ...
Vercel Ships Next.js 16.4.1 Fixing Two Critical RCE Flaws
Vercel released Next.js 16.4.1 and 15.5.28 to fix two critical unauthenticated remote code execution flaws and a high-severity denial-of-service bug in apps.
North Macedonia Charges Alleged OLVX Marketplace Administrator
North Macedonia charged the alleged administrator of the OLVX cybercrime marketplace in the first FBI joint cyber operation with the country, officials said.
Aoki Infostealer Now Steals API Keys From AI Coding Assistants
October 16, 2026
Symantec reports new Aoki infostealer variants that take credentials and session files from Claude, Codex, Cursor, Gemini, Copilot and AWS
X Removes 13,000 Accounts Tied to Foreign Influence Operations
October 16, 2026
X says it removed more than 13,000 accounts in three suspected foreign influence operations linked to Iran, Russia and China,
GreyNoise: Proxyjacking Campaign Hijacks D-Link, Ubiquiti Devices
October 16, 2026
GreyNoise found a proxyjacking campaign that compromised at least 143 edge devices in 34 countries, installing Pawns.app to resell victims’
GhostBat Android RAT Targets 60 Indian Banking and UPI Apps
October 16, 2026
Cyble describes an updated GhostBat Android RAT that uses a Ghost Overlay to steal UPI PINs from 60 Indian financial
Cisco Secure Email Gateway Zero-Day CVE-2026-76519 Exploited
October 15, 2026
Cisco confirms attackers are exploiting CVE-2026-76519, a CVSS 9.8 Secure Email Gateway flaw that gives root access, the second such
Palo Alto Patches PAN-OS RCE Zero-Day CVE-2026-0322 Under Attack
October 15, 2026
Palo Alto Networks patched CVE-2026-0322, a PAN-OS management interface RCE giving root access that is under limited exploitation, and CISA
Microsoft Seizes Domains of Chinese Phishing Kits Behind 1B Messages
October 15, 2026
Microsoft, Health-ISAC and partners seized domains tied to the CoGUI, Haozi and Iron Man phishing kits and YAM Store, linked
Vercel Ships Next.js 16.4.1 Fixing Two Critical RCE Flaws
October 15, 2026
Vercel released Next.js 16.4.1 and 15.5.28 to fix two critical unauthenticated remote code execution flaws and a high-severity denial-of-service bug
North Macedonia Charges Alleged OLVX Marketplace Administrator
October 15, 2026
North Macedonia charged the alleged administrator of the OLVX cybercrime marketplace in the first FBI joint cyber operation with the
Trending
Daily Briefing Newsletter
Subscribe to the Daily Security Review Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.