The Edge of the Cyber World See the latest
Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below – CVE-2026-76581 (CVSS score: 9.8) – An authentication bypass flaw in
Open a fresh Node.js project in August 2026 and the first decision you make isn’t a framework or a database. It’s which command installs your dependencies. npm still ships in the box with every Node.js download. pnpm just pushed a major version bump to 12.1.0 and quietly became the most-downloaded package manager on the npm…
Credential stuffing has quietly become the default way attackers break into APIs. Bots armed with billions of leaked username-password pairs no longer bother guessing passwords character by character — they replay credentials stolen from other breaches, betting that people reuse logins across services. According to an authentication threat report published by MojoAuth, defenders blocked 4.2…
A cybercriminal operating under the alias “TheHatman” is selling roughly 3.6 million employee-directory records allegedly pulled from the Microsoft Azure and Entra ID tenants of nine large companies, according to cybercrime intelligence firm Hudson Rock. The victim list includes McDonald’s, Vodafone, Tata Consultancy Services (TCS), Kyndryl, HCL Technologies, InterContinental Hotels Group (IHG), Gap Inc., Hexaware…
A threat actor broke into the release pipeline of one of the most widely used open-source security tools on the planet, and the tool at the center of it was itself a vulnerability scanner. On March 19, 2026, attackers used compromised credentials to push a malicious build of Trivy, Aqua Security’s open-source container scanner, then…
McKesson Corporation, the pharmaceutical distribution giant that moves roughly a third of the prescription drugs sold in the United States, confirmed on August 28, 2026, that it suffered a cybersecurity incident involving unauthorized access to third-party applications and theft of data. Hours after the disclosure, the extortion group ShinyHunters told BleepingComputer it had pulled roughly…
A ransomware crew that built its reputation on mass file-transfer hacks has pulled off something different this month. Cl0p, the extortion group behind the 2023 MOVEit breach, has spent August 2026 naming Shell, Philips, General Electric, Fiserv and roughly 45 other companies on its dark-web leak site. The common thread isn’t a shared vendor for…
The leaker behind this month’s Grand Theft Auto 6 footage dump appears to have finally shown its hand. On August 27, 2026, blockchain investigators traced roughly $270,000 in transactions out of wallets linked to the anonymous group known as Cyberleek, the same entity that spent the previous two weeks flooding the internet with GTA 6…
OpenAI and more than 100 partner companies published an open letter on August 27, 2026, warning that AI models could within months become powerful enough to let attackers launch sharply more sophisticated cyberattacks against hospitals, water treatment plants, and other critical infrastructure, according to Fox Business. The letter calls for a coordinated global defense push…
Kerberoasting has been sitting on the MITRE ATT&CK list since 2018, but 2026 is the year it finally forced Microsoft’s hand. In January 2026, Microsoft began shipping Kerberos protocol hardening updates tied to CVE-2026-20833, a Windows Kerberos information disclosure flaw (CVSS 5.5) that exists precisely because RC4-HMAC is still allowed as a fallback encryption type…
