VulnHub

Attackers are exploiting two serious vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress, allowing unauthorized users to log in as any WordPress user, including those with administrative privileges. These vulnerabilities, identified as CVE-2026-61979, have a CVSS score of 8.1, indicating a high severity level. This situation puts numerous WordPress sites at risk, as it could enable attackers to gain complete control over these sites without needing valid credentials. The vulnerabilities were disclosed by Patchstack, underscoring the need for site administrators to take immediate action. Promptly addressing these flaws is crucial to prevent unauthorized access and potential data breaches.

Hackers are exploiting two serious vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. These flaws allow attackers to bypass authentication, potentially enabling them to log in as site administrators without proper credentials. This poses a significant risk to websites using the affected plugin, as unauthorized access could lead to data breaches or site manipulation. WordPress site owners need to be aware of this security issue and take prompt action to secure their installations. It's crucial for users to update their plugins and monitor for any suspicious activity to mitigate these risks.

This week saw a rise in attacks leveraging AI to exploit Programmable Logic Controllers (PLCs), which are crucial in industrial automation. Researchers noted that trusted tools have been manipulated, making it easier for attackers to exploit existing vulnerabilities in these systems. Additionally, there were reported breaches involving GitLab, where sensitive data was compromised, and Stripe faced key leaks that could jeopardize user accounts. These incidents emphasize the need for companies to prioritize security measures and update their systems regularly to fend off these evolving threats. The implications are significant, as industries rely heavily on these technologies, and any exploitation can lead to serious operational disruptions.

Apollo, a private equity firm, recently experienced a data breach that compromised sensitive personal data after attackers gained access to its cloud platforms over a five-day period in early July. This incident is part of a broader trend of cyberattacks targeting the financial sector, raising concerns about the security of sensitive information in this industry. The breach not only affects Apollo but potentially impacts clients and individuals whose data was compromised. As attackers continue to exploit vulnerabilities in financial institutions, it highlights the pressing need for stronger cybersecurity measures to protect personal data from unauthorized access. Companies in the financial sector must reassess their security protocols to prevent future incidents like this.

Researchers have identified a new phishing toolkit known as iAuthFlow V2 that allows attackers to register a passkey they control. This capability enables them to maintain access to user accounts even after victims change their passwords or revoke active sessions. The toolkit poses a significant risk as it undermines traditional security measures that rely on passwords. Users of affected services need to be vigilant about phishing attempts that aim to exploit this vulnerability. This development raises concerns about the effectiveness of password-based security and the potential for ongoing unauthorized access to personal accounts.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has directed federal agencies to prioritize fixing two vulnerabilities in the TrueConf Server, a self-hosted communications platform. These vulnerabilities are currently being actively exploited, posing a significant risk to users, particularly within government operations. The urgency of this directive underscores the potential for attackers to exploit these flaws to gain unauthorized access or disrupt communications. Agencies are advised to apply the necessary patches immediately to safeguard their systems from potential breaches. The situation emphasizes the ongoing need for vigilance in maintaining secure communication platforms, especially those used in sensitive environments.

Cl0p, a notorious ransomware group, has claimed responsibility for attacks on over 40 organizations by exploiting a vulnerability in PTC Windchill and FlexPLM software. This approach is typical for Cl0p, as they often target a single flaw in enterprise systems to maximize their impact across multiple companies. If organizations refuse to pay the ransom, Cl0p threatens to publish their names, increasing pressure to comply. The widespread nature of this attack illustrates the risks associated with vulnerabilities in widely used enterprise software and highlights the importance of timely patching and security measures. Companies using these systems should be on high alert and assess their security posture to prevent falling victim to similar attacks.

This week, several security vulnerabilities have emerged, highlighting significant risks in trusted software and systems. Notably, Gogs version 10.0 has a remote code execution (RCE) vulnerability that attackers can exploit, while n8n has a similar issue that allows workflows to trigger RCE. Additionally, researchers have noted that signed drivers can be misused to bypass security measures, and a weak header check in certain applications opens further avenues for code execution. These vulnerabilities affect a range of users and organizations that rely on these tools, and the ease of exploitation, especially with the aid of AI, raises alarms about the potential for widespread attacks. Companies should prioritize patching and monitoring their systems to mitigate these risks.

The U.S. government has issued a warning about an ongoing threat to critical infrastructure organizations, specifically targeting Siemens S7 Series Programmable Logic Controllers (PLCs). Attackers are using artificial intelligence to create exploit scripts that mimic legitimate monitoring tools. This tactic allows them to conduct reconnaissance and develop capabilities against these PLCs. The implications of this threat are significant, as successful exploitation could disrupt vital operations in sectors like energy, manufacturing, and transportation. Organizations that use Siemens S7 PLCs need to remain vigilant and update their security measures to defend against these advanced AI-generated attacks.

A serious vulnerability in Zimbra Collaboration Suite (ZCS) has been found and is currently being exploited by attackers. The flaw, identified as CVE-2026-73570, has a high severity score of 8.9 and allows for unauthenticated remote code execution through command injection. This means that attackers could potentially take control of affected systems without needing any prior authentication. The Polish Computer Emergency Response Team (CERT Polska) has warned users that this vulnerability is actively being exploited in the wild. Organizations using Zimbra are urged to apply the latest security patches immediately to mitigate the risk of attack.

A recent advisory from the US government has alerted industrial control system (ICS) operators to a new type of threat targeting Siemens S7 Series programmable logic controllers (PLCs). According to the advisory, attackers are using AI-generated scripts to exploit vulnerabilities in these exposed systems. This raises significant concerns for industries relying on these PLCs, as the potential for disruption or damage to critical infrastructure is high. Siemens PLCs are widely used in manufacturing and utilities, making them attractive targets for cybercriminals. Operators are urged to assess their security measures and ensure that their systems are properly protected against these AI-driven attacks.

CERT Polska has alerted users that a serious vulnerability in Zimbra Collaboration Suite (ZCS) is currently being exploited by attackers. This flaw allows for remote code execution, which means that unauthorized individuals could potentially take control of affected systems. Organizations using ZCS should be particularly vigilant as this vulnerability poses a significant risk to their data and operations. Users are advised to check for updates and apply any available patches immediately to mitigate the risk. The situation is urgent as the exploitation of this vulnerability is already occurring in the wild, making timely action crucial for affected organizations.