A critical WordPress exploit chain dubbed WP2Shell lets unauthenticated attackers run arbitrary code on vulnerable websites ...

Roundcube Webmail SQL injection flaw CVE-2026-48842 is actively exploited, urging users to update vulnerable installations.

Roundcube SQL injection CVE-2026-48842 is now being exploited in the wild, putting unpatched webmail servers at risk of database compromise.

Hello, this is Nishizawa, a Cloudflare enthusiast.Cyberattacks have been increasing recently, and WordPress is a frequent target.It is often dismissed by saying "WordPress is vulnerable," but in ...

Introductory ColumnDo attackers know the answer from the start?Paths that appear in server access logs almost every day.

Explore the latest news, real-world incidents, expert analysis, and trends in Drupal — only on The Hacker News, the leading ...

CyberXero, a Russian-speaking threat group, is using common hacking tools and AI to run two distinct campaigns: Common IAB ...

Drupal patched a critical Field UI RCE flaw reachable through contributed modules, including one known path that requires no ...

SOCRadar found CyberXero running 51 Claude Code AI agents to steal 628,000 Ukrainian energy records. Here's how the attack ...

CyberXero used 51 AI agents to support cyberattacks, stealing 628,000 Ukrainian records, including sensitive data from energy ...

Attackers are exploiting CVE-2026-48842 against unpatched Roundcube servers months after a fix was released, raising urgency for organizations to update.

Discover how the TikTok WordPress Toolkit could enable hackers to steal AWS, SMTP, and API credentials, posing serious security risks to users.