'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover

Source: Dark Reading

Attackers are exploiting two critical WordPress flaws chained as WP2Shell to achieve unauthenticated remote code execution on default installations. The article reports widespread exploit attempts, public proof-of-concept activity, forced security updates, and guidance to inspect sites for backdoor accounts, malicious plugins, and suspicious files even after patching.

Link to article

Critical ServiceNow code execution flaw now exploited in attacks

Source: BleepingComputer

BleepingComputer reports active exploitation of CVE-2026-6875, a critical ServiceNow AI Platform flaw that can allow unauthenticated sandbox escape and remote code execution in high-complexity attacks. ServiceNow says hosted instances have been addressed and urges customers to apply relevant updates, especially for self-hosted deployments.

Link to article

Cyberattack Disrupts Operations of Japanese Frozen Food Giant Nichirei

Source: SecurityWeek

Nichirei disconnected systems after a cyberattack disrupted refrigerated warehouse and shipping operations across parts of its food and logistics business. SecurityWeek reports the company is gradually restoring service, investigating whether personal information was exposed, and has submitted an initial report to Japan’s Personal Information Protection Commission.

Link to article

New Check Point Zero-Day Vulnerability Exploited in the Wild

Source: SecurityWeek

Check Point warned customers that CVE-2026-16232, an authentication bypass in Security Management and Multi-Domain Management products, has been exploited against certain internet-exposed environments. The flaw can allow attackers to obtain an application login token, access SmartConsole with administrator privileges, and change security policy or configuration.

Link to article

SonicWall SMA1000 flaws exploited as zero-days to push custom malware

Source: BleepingComputer

BleepingComputer details how attackers exploited SonicWall SMA1000 vulnerabilities CVE-2026-15409 and CVE-2026-15410 as zero-days before public disclosure. Volexity linked the activity to a previously unknown actor using appliance-focused custom malware, webshells, proxy tooling, and access paths that could expose credentials and internal applications.

Link to article