🕵️ RESEARCH & DEEP DIVES
- Australia arrests two alleged TeamPCP members over global supply-chain attacks
Australian authorities arrested two alleged TeamPCP members over global supply-chain attacks.- Open-source developers and organizations across government, academia, and the private sector were affected.
- TeamPCP allegedly compromised Trivy, LiteLLM, Telnyx, KICS, TanStack, and other packages and platforms.
- The campaign potentially breached more than 1,000 organizations, stealing over 500,000 credentials and 300 GB of data.
- Attackers injected malicious code into trusted repositories that developers unknowingly incorporated into their systems.
- The Mini Shai-Hulud worm stole credentials and authentication tokens, then self-propagated across package registries and CI/CD environments.
📎 Coverage: techcrunch.com · 👁 via Risky Business News
📋 ADVISORIES
- 📄 Source for TranslatePress <=3.3.3 Exposes WordPress Sites to Unauthenticated Stored XSS — wordfence.com
🔓 CVEs & KEV
-
CVE-2026-18983 — CVSS 7.5 — One User Avatar | User Profile Picture through 2.5.4 - Authenticated (Subscriber+)...
-
CVE-2026-18324 — CVSS 7.2 — Forminator Forms through 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting vi...
-
CVE-2026-18978 — CVSS 7.2 — LiteSpeed Cache through 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Co...
-
CVE-2026-77365 — CVSS 7.2 — Optimole through 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (abo...
-
CVE-2026-16759 — CVSS 6.5 — Tutor LMS through 4.0.5 - Unauthenticated Remote Code Execution via 'template' and...
-
CVE-2026-16654 — CVSS 6.4 — Avada (Fusion) Builder through 3.15.6 - Authenticated (Contributor+) Stored Cross-...
-
CVE-2026-3129 — CVSS 6.4 — LiteSpeed Cache through 7.7 - Authenticated (Author+) Stored Cross-Site Scripting ...
-
CVE-2026-82081 — CVSS 6.4 — wallabag 2 through 2.6.14 allows SSRF because a crafted title or content fiel...
-
CVE-2026-15798 — CVSS 6.4 — Smart Slider 3 through 3.5.1.38 - Authenticated (Contributor+) Stored Cross-S...