New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
An anonymous HTTP request can run code on a WordPress site. The bug is in core, so a bare install with zero plugins is exploitable.
Every 6.9 and 7.0 site was in range until Friday, when WordPress shipped 6.9.5 and 7.0.2 and enabled what it calls forced updates through its auto-update system.
Adam Kues at Assetnote, Searchlight Cyber’s attack surface management arm, found the flaw and reported
Source: The Hacker News
Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server cPanel has released patches for a security flaw affecting domain parking and addon domain functionality
Google and Microsoft Pull ModHeader With 1.6 Million Installs After Dormant Collector Found Google and Microsoft have pulled ModHeader, a popular header-editing extension with roughly 1.6 million installs across Chrome
Watchtower Attack Update. Hier die aktuellen Top 5 Attack-IPs, die auf doode.info klopfen. 45.148.10.21 — 2971 requests (recent log) 89.167.35.212 — 600 requests (recent log) 23.234.75.87 — 392 requests (recent