Two critical security flaws in WordPress are being actively exploited by hackers to remotely take over websites. A cybersecurity researcher estimates tens of millions of sites could be affected.
The Vulnerability
Two critical bugs in WordPress software have created a window for attackers to gain remote code execution on vulnerable websites. The flaws were recently patched, but hackers are already exploiting unpatched installations.
Scale of Impact
The potential reach is substantial. WordPress powers approximately 43% of all websites globally, making it a prime target. Cybersecurity researchers estimate that tens of millions of websites could be compromised if administrators fail to apply the patches promptly.
Active Exploitation
Attackers are not waiting. Reports indicate active exploitation campaigns targeting websites still running vulnerable versions of WordPress. Once compromised, hackers gain the ability to execute arbitrary code, install malware, steal data, or redirect traffic.
Affected Sites
Small businesses, blogs, e-commerce platforms, and enterprise websites are all potentially at risk. Any WordPress installation that hasn't been updated to the patched version remains vulnerable.
Recommended Actions
WordPress administrators should immediately:
- Update WordPress to the latest patched version
- Update all plugins and themes
- Enable automatic updates if possible
- Review site access logs for suspicious activity
- Consider using security plugins for added protection
Timeline Matters
The window between patch release and widespread exploitation is often narrow. Website owners who delay updates significantly increase their risk of compromise.
This incident underscores the critical importance of timely security patching across web infrastructure. With WordPress powering such a large portion of the internet, vulnerabilities in the platform have immediate, widespread implications.
QBittorrent, the popular open-source torrent client, has been found capable of breaking out of sandbox environments to execute unauthorized operations. Security researchers identified the vulnerability, raising concerns about the application's access to system resources.
Threat actors are deploying invisible Unicode characters in phishing campaigns to evade email security systems. The ASCII smuggling technique allows attackers to conceal malicious content from detection tools.
A Unicode block invisible to human readers has transitioned from an academic curiosity used to test AI systems into an active tool for spammers. The technique exploits characters that machines process but humans cannot see.
A study found that 86% of licensed British gambling websites violate GDPR privacy requirements, using deceptive cookie banners to track users before obtaining consent.