One person, over 1,000 AI-agent tasks: How website attacks are changing
Researchers exposed control panels used to direct AI agents against shops and websites. Here's what NorForge and Reuters actually confirmed, and how to protect your WordPress…
Read more → Security · NewsResearchers found over 6,800 AI chat links in DNS data. No hacking required
Researchers found over 6,800 hostnames linked to Meta Muse shares in passive DNS records. Some pages exposed sensitive material. Here's how it happened and how Meta…
Read more → Security · NewsWhen a placeholder domain becomes a trap: a real-world example
Domains used for years as harmless placeholders have started serving dangerous and deceptive content. Researchers found similar addresses in hundreds of thousands of GitHub files. For…
Read more → Security · NewsAdmin Menu Editor Pro distributed a web shell through its official update channel. The replacement version was compromised too
Admin Menu Editor Pro distributed an update containing a web shell from its official server, and a few hours later the supposedly clean replacement version was…
Read more → Security · NewsAn online store can look perfectly normal and still run malicious JavaScript. Cloudflare shows four campaigns
Cloudflare describes four malicious JavaScript campaigns targeting online stores. Seven of eight payloads were not listed in VirusTotal, and some of the code activated only for…
Read more → Security · News395 organizations, 440 PaperCut instances and hundreds of AI agents: the attack shows a new scale of automation
GreyNoise describes a real PaperCut campaign that used hundreds of AI agents. At least 440 instances across 395 organizations were compromised, while full domain-admin access was…
Read more → SecurityWordPress has started stopping risky plugin updates. AI checks them before distribution
WordPress.org has introduced an automated security gate for plugin releases. Several AI models and Jetpack Scan analyse the code, and high-risk versions are stopped before distribution.
Read more → SecurityClaude reached the open internet during testing. Anthropic reveals a fourth incident and reviews 481 million transcripts
Anthropic disclosed a fourth case in which Claude gained access to a real system during a poorly isolated cybersecurity test. The company expanded its review to…
Read more → Security · NewsOpenAI confirms the “wiki incident”. Agents used the German DSEWiki for unauthorised collaboration during testing
OpenAI confirmed an incident in which agents used the German DSEWiki as shared memory and a collaboration channel during internal tests. It was not a production…
Read more → SecurityWPML, used on more than 1.5 million sites, had an SQL injection flaw. A Subscriber account was enough
CVE-2026-17509 describes an SQL injection flaw in WPML Multilingual CMS up to and including version 4.9.5. The attack required a logged-in account, but the Subscriber role…
Read more →