Attackers are actively exploiting a public proof-of-concept for the WordPress "wp2shell" vulnerability, which allows remote code execution. The release of the exploit has led to widespread scanning and attacks on unpatched WordPress sites. This increases the risk of site compromise if administrators do not apply available security updates.

A new ransomware strain named ENCFORGE is exploiting a remote code execution vulnerability in Langflow to encrypt AI model files. The attack targets users of Langflow, an open-source tool for building AI applications. This matters because it underscores the increasing risk to AI infrastructure and the need to secure model files against targeted ransomware.

A widespread campaign called FakeGit has deployed over 7,600 fraudulent GitHub repositories to distribute SmartLoader malware. The repositories are designed to trick users into downloading malicious files disguised as legitimate projects. This large-scale operation poses a significant threat to developers and open-source users who might inadvertently install the malware.

Cybersecurity researchers discovered the HollowGraph malware, which conceals its command-and-control server and stolen files within Microsoft 365 events timestamped in the year 2050. This novel evasion technique exploits future-dated calendar entries to bypass detection. The discovery highlights the evolving sophistication of threats targeting cloud services.

This week's security recap covers critical vulnerabilities, including a WordPress remote code execution flaw, multiple SonicWall zero-days, attacks targeting AI services, and a SharePoint zero-day exploit. These issues require urgent patching and highlight ongoing threats to widely-used platforms and infrastructure.

A common security myth suggests that a specific vulnerability ("Mythos") breaks security programs, but the real danger is the duration that systems remain exposed. Organizations need to focus on reducing exposure windows rather than chasing false alarms, as unpatched vulnerabilities pose a greater threat. This matters because misdirected security efforts waste resources and increase risk.

Security expert Bruce Schneier examines the widespread deployment of automated license plate recognition cameras by Flock Safety. These cameras, used by law enforcement and private communities, raise significant privacy issues due to their extensive tracking capabilities and lack of oversight. The discussion highlights the tension between public safety and civil liberties in the age of ubiquitous surveillance.

A Russian-speaking hacker leveraged Google Gemini's command-line interface to remotely control a botnet consisting of eight computers at a dental clinic. The incident demonstrates how AI-powered tools can be misused for cyberattacks, even on small-scale targets, raising concerns about new attack vectors.

Researchers find that prompt injection attacks are effectively stopping AI-powered hacking agents from carrying out malicious tasks. By feeding crafted inputs, attackers can mislead the AI, highlighting a new vulnerability in autonomous cybersecurity systems. This matters because it reveals both a defensive opportunity and a risk for AI-driven security tools.