Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

The critical WordPress vulnerability CVE-2026-87902 is being actively exploited, with activity progressing from reconnaissance to attempts to write malicious PHP files on vulnerable servers. The flaw affects WordPress Core versions 4.7.0 through 7.1.1 and has been fixed in WordPress 7.1.2 …

CISA Warns of WSO2 Multiple Products Vulnerability Exploited in Attacks

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical WSO2 vulnerability (CVE-2026-5430) to its Known Exploited Vulnerabilities catalog, warning that attackers are actively exploiting the flaw in real-world attacks. The issue affects several WSO2 products used to …

Sudo Security Vulnerability Lets Attackers Escalate Privileges

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

A high-severity security vulnerability in Sudo could allow local attackers to bypass time-based access restrictions and run commands with elevated privileges. Tracked as CVE-2026-96512, the flaw affects Sudo versions from 1.8.20 through 1.9.17p2 and involves unsafe handling of the TZ …

Salesforce Indirect Prompt Injection Vulnerability Enables 0-click Data Exfiltration

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Zenity Labs disclosed a now-patched Salesforce Agentforce vulnerability, dubbed SalesBleed, that could have allowed attackers to steal sensitive CRM data without logging in, accessing a target Salesforce tenant, or requiring victim interaction. The attack relied on indirect prompt injection delivered …

New MacSync Malware Turns macOS Apps Into Tools for Crypto and Password Theft

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

MacSync, a fast-changing macOS information stealer, has returned with a more complex delivery chain aimed at people who use cryptocurrency and developer tools. Instead of relying mainly on a pasted Terminal command, the latest activity begins with malicious disk-image files …

Duelbits Confirms $7 Million Hot-Wallet Hack, forcing Systems offline

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Crypto casino Duelbits has confirmed a cybersecurity breach that drained approximately $7 million from its hot wallets, forcing the platform offline while investigators establish the attack’s root cause. Co-founder Joe disclosed the incident on X, assured customers that user funds …

Hackers Exploited Ethereum Bridge Contract to Drain Full Balance from Payy Network

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Payy Network has confirmed that attackers exploited its Ethereum bridge contract and drained the contract’s entire balance, forcing the stablecoin payments platform to suspend network and wallet functions. According to a public statement from Payy, the incident occurred at approximately …

Bitget Hot Wallet Hacked – Attackers Stole $351.6 Million From Hot Wallets

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Cryptocurrency exchange Bitget has confirmed a security breach affecting approximately $351.6 million in assets after unauthorized transfers were detected in parts of its hot and warm wallet infrastructure. The incident was identified at 18:31 UTC on September 24, 2026, prompting …

Cloudflare Containers Vulnerability Could Leak Data Between Customer Workloads

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Cloudflare has patched a cross-tenant data exposure vulnerability in its Containers platform across its global, multi-tenant cloud computing infrastructure that could allow one customer’s workload to recover residual disk data left by another tenant on the same physical host. The …

SCOUTz Prospect Intelligence Platform Launches for MSPs with 30-Day Beta

Blog WriterCybersecurity News - Original News Source is cybersecuritynews.com

Phoenix, Arizona, September 24th, 2026, CyberNewswire SCOUTz, a prospect intelligence platform built for managed service provider (MSP) security sales, is now available in open beta. The platform gives an MSP dated evidence about a prospect’s environment before the first meeting …