Latest cybersecurity threats, data breaches, hacking incidents, security vulnerabilities, ransomware attacks, and expert guidance on digital security.
Public exploits for the 'wp2shell' attack chain targeting WordPress Core have been released, enabling pre-authentication remote code execution on versions 6.9.x and 7.0.x. WordPress has activated forced automatic security updates, urging site owners to update to 7.0.2 or 6.9.5 immediately.
Homeland Security Secretary Markwayne Mullin pledged to aggressively pursue voter fraud cases at the White House complex on Friday, following President Donald Trump's primetime speech that revived debunked election theories. Trump used the address to push for stricter voter ID laws without providing evidence of widespread fraud.
Researchers from Tracebit developed 'context bombing,' a technique using prompt injections alongside secrets in AWS to stop AI hacking agents. In tests across five leading models, full account admin seizure dropped from 57% to 5%, and complete compromise fell from 36% to 1%. The most capable agent, Opus 4.8, went from 93% success to failing every time.
Abbott Laboratories is investigating unauthorized access to legacy Exact Sciences systems and a separate breach claim of its LabCentral portal. The ShinyHunters extortion gang added Abbott to its leak site, threatening to publish stolen data unless Abbott negotiates, with a deadline extended to July 21. Abbott says the incidents won't materially impact operations or finances. New facts indicate LabCentral contained only publicly available technical documents.
At an Axios House D.C. event, defense and tech leaders stated that AI is accelerating the pace of digital attacks and increasing the need for resilient systems. CrowdStrike's Drew Bagley noted AI adoption has expanded potential targets, while Domino Data Lab's Chris Talevi advised treating AI like a trusted insider with variability.
7-Zip released version 26.02 to patch a heap-based buffer overflow in XZ processing that could allow remote code execution via crafted files. The flaw was disclosed by researcher Landon Peng. Users must manually update from 7-zip.org as the software lacks auto-update.
A vulnerability named HollowByte allows unauthenticated attackers to trigger a denial-of-service condition on OpenSSL servers with an 11-byte payload. The OpenSSL team silently fixed the vulnerability and backported the patch. Okta's Red Team disclosed the flaw, which causes memory fragmentation and permanent bloat in servers using glibc, requiring a restart.
Unknown hackers hacked the official website of Kenyan President William Ruto, defacing it with offensive messages and demanding 5 bitcoins ($320,000) by Saturday 6 p.m. They threatened to leak sensitive government data. ICT authorities activated cybersecurity protocols.
This commentary argues that the massive global audience for the 2026 FIFA World Cup has created a lucrative black market for compromised streaming accounts. It contends that cybercriminals are exploiting high demand for cheaper access, with over 12 million compromised accounts valued at nearly $220 million, highlighting a growing cybersecurity threat tied to major sporting events.
Zyaire Wilkins, 21, was arrested Tuesday for conspiracy to embed malware in Steam video games, infecting 8,000 devices and stealing $220,000 in cryptocurrency from 80 wallets between May 2024 and February 2026. The malicious games included BlockBlasters, Dashverse, Lampy, Lunara, and PirateFi. Valve had previously removed PirateFi and other games containing malware.