Cybersecurity briefing, 2026-09-22

WordPress exploitation led the briefing, with default credentials helping attackers steal more than 18,000 government records.

• WordPress Exploit Hit Government Sites Through Default Logins
• CloudSEK Finds Trusted Publishing Was Abused
• Fake LastPass Authenticator Repos Push Rapuncel
• Google Kept Gemini Breaches Quiet for Seven Weeks
• Rust Crate Owners Face Recruiter-Style Account Theft
• CrowdSec Leak Traced to Stale GitHub Access
• Gyazo Leak Exposes Passwords and Image Links
• OpenAI Logs Six Agent Misalignment Incidents
• Jade Sleet Used Terraform to Reach Developer Macs
• ShinyHunters Raises the Cost of Cl0p's Leak-Site Breach
• Kaspersky Finds Torrent Archive Feeding Cross-Sector Malware
• RatHat Uses Android Accessibility as Control Surface
• Contagious Interview Turns Hiring Into a Laundering Channel
• ChainScript Hides C2 Behind Polygon Lookups
• WordPress 7.1.1 Fixes Silent Theme Install Bug

Recent editions

• Monday, September 21, 2026: WordPress Exploit Hit Government Sites Through Default Logins · 20 stories
• Sunday, September 20, 2026: Orkes Conductor Bug Turns Workflows Into Shell Access · 5 stories
• Saturday, September 19, 2026: Orkes Conductor Bug Turns Workflows Into Shell Access · 17 stories
• Friday, September 18, 2026: Redis TLS Bug Is Already Being Exploited · 17 stories
• Thursday, September 17, 2026: JCE Flaw Is Turning Joomla Sites Into Webshell Hosts · 16 stories
• Wednesday, September 16, 2026: WSO2 JWT Bypass Is Being Used in Attacks · 17 stories
• Tuesday, September 15, 2026: Vite Exploitation Is Now Harvesting Cloud Secrets · 17 stories