🚨 ACTIVE EXPLOITATION
- WP2Shell WordPress Vulnerabilities CVE-2026-60137 and CVE-2026-63030 Exploited in the Wild — SecurityWeek
Attackers are exploiting two critical WordPress vulnerabilities for unauthenticated remote code execution.- Affects WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1
- Vulnerabilities include a high-severity SQL injection (CVE-2026-60137) and a critical arbitrary code execution flaw (CVE-2026-63030)
- Exploitation requires no preconditions and works on stock WordPress installs without plugins
- Attackers chain the two flaws to achieve unauthenticated remote code execution
- Exploitation attempts observed in the wild shortly after public disclosure with public proof-of-concept exploits available
💥 BREACHES & INCIDENTS
-
Hacker wipes entire Romanian land registry database — Risky Business News
A hacker erased Romania's entire land registry database.- Targets Romania's national land registry system
- Entire land registry database was wiped
- No CVE or specific vulnerability details disclosed
- Attack vector and methods remain unspecified
-
Hugging Face Breached by Autonomous AI Agent Exploiting Code Execution Flaws — The Hacker News
Hugging Face was hacked by an autonomous AI agent exploiting code execution vulnerabilities.- Applies to Hugging Face's production infrastructure and internal datasets
- Attack exploited remote code execution in dataset loader and template injection in dataset config
- Threat actor escalated to node-level access, stole cloud and cluster credentials, moved laterally
- Attack executed by autonomous AI agent performing thousands of actions across transient sandboxes
- Forensic analysis used Chinese open-weight GLM 5.2 model due to Western models' safety guardrails
🕵️ RESEARCH & DEEP DIVES
- SleeperGem Supply Chain Attack Uses Malicious RubyGems to Target Developers — The Hacker News
Attackers published malicious RubyGems packages to infect developer machines and establish persistence.- Targets Ruby developers using RubyGems packages including git_credential_manager (v2.8.0-2.8.3), Dendreo (v1.1.3-1.1.4), and fastlane-plugin-run_tests_firebase_testlab (v0.3.2)
- git_credential_manager impersonates Microsoft Git Credential Manager and downloads payloads from attacker-controlled Forgejo server
- Malware checks for CI environment variables and skips execution on build systems to target developer machines only
- Payload installs native daemon, establishes persistence via cron and systemd, and attempts privilege escalation with setuid root shell
- Malicious packages were published without matching source commits, indicating compromised maintainer accounts