WordPress Has a Critical Hole — And CISA Left Its Own Keys in Public View
Sunday, July 19, 2026 · 5-minute read
A Chinese cybercrime group called GoldenEyeDog broke into DigiCert in April 2026, using a remote access trojan to get onto a support employee's device. From there, they stole code-signing certificates meant for DigiCert's customers. Those stolen certificates are dangerous — software signed with them could fool your computer into trusting something malicious.
↗ The Hacker NewsMicrosoft's July Patch Tuesday fixed 570 vulnerabilities, nearly triple last month's record. The company says AI-assisted vulnerability discovery is why the numbers are climbing so fast. Almost 60 of those bugs were rated critical, meaning attackers could take over a Windows PC with little or no help from the user. Three were zero-days, and two of them were already being used in real attacks before the patch dropped.
↗ Krebs on SecurityMedical device giant Abbott confirmed that attackers got into internal systems tied to its Exact Sciences cancer diagnostics business. Separately, someone claims to have breached its LabCentral portal and stolen company data. Abbott is investigating both incidents. The combination of a healthcare target, stolen data claims, and extortion pressure is an increasingly common playbook — and patient-related data makes the stakes especially high.
↗ BleepingComputerA botnet called NadMesh turned up in early July doing something specific: hunting for AI tools — like ComfyUI, Ollama, and Langflow — that teams have set up quickly without proper security. When it finds one, it harvests whatever cloud credentials it can grab. The operators' own dashboard, captured on July 10, boasted 3,811 unique AWS keys. These tools are popular because they're easy to spin up — but "easy to spin up" often means "easy to leave exposed."
A new piece of Mac malware called ClickLock uses a clever — and alarming — trick. It kills every visible app on your screen, leaving you staring at a freeze. Your Mac then prompts you for your login password to "fix" the problem. You type it in. The malware captures it and sends it to the attackers. Unlike most Mac malware that tries to stay hidden, ClickLock actively gets in your face to steal your system password.
Two bugs in WordPress core — chained together — let a complete stranger on the internet run any code they want on your website. No login required. No plugins needed. A bare WordPress install on version 6.9 or 7.0 was fully exposed. One bug confuses WordPress's REST API, and the other is a SQL injection in core. Together, they hand an attacker full control. A working exploit is now public on GitHub, which means automated attacks are likely already underway.
Status: Patch available — WordPress 6.9.5 and 7.0.2 fix both bugs and were pushed via forced auto-update on Friday. Check your site's version now even if you have auto-updates enabled.
OpenSSL has a bug called HollowByte. An attacker can send just 11 bytes to an unpatched server and make it set aside up to 131 KB of memory — for data that never arrives. Do this repeatedly and the server runs out of memory and stops responding. Think of it like calling a restaurant, claiming you're bringing 500 guests, then never showing up — and the kitchen can't serve anyone else because it prepared for your party. The tricky part: the fix was quietly shipped in June with no CVE, no advisory, and nothing for automated scanners to flag.
Status: Patch available — fixed in OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21 (all dated June 9, 2026). Your scanner probably won't flag this automatically — check your OpenSSL version manually.
A security researcher published a working exploit for a Windows zero-day called LegacyHive. It lets an attacker who already has basic access to a Windows PC quietly escalate to full administrator privileges — even on a fully patched, up-to-date system. That's the worst kind of privilege bug: it means getting a foothold anywhere on the machine is enough to eventually own the whole thing. Microsoft has not yet released a fix.
Status: No patch yet. Microsoft is aware. Limit who has local access to sensitive Windows machines and watch for unusual privilege changes until a fix arrives.
7-Zip, the free file compression tool used by hundreds of millions of people, just patched a remote code execution flaw. If an attacker can get you to open a specially crafted compressed file — a .zip, .7z, or similar archive — they can run malicious code on your computer. This is a classic "just open this file" attack, and those are dangerous because they require almost no technical skill from the attacker.
Status: Patch available — update to 7-Zip version 26.02. Since 7-Zip doesn't auto-update, you'll need to download the new version from 7-zip.org manually.
The ViteVenom malware campaign — seven fake npm packages targeting JavaScript developers — introduced something security researchers are calling ChainVeil: a command-and-control system built on top of public blockchains including Tron, Aptos, and Binance Smart Chain. Normally, security teams can shut down criminal infrastructure by seizing servers or blocking domains. With blockchain-based C2, the instructions live on a decentralized ledger that no single government or company controls. Discovered by Checkmarx's researchers, this four-tier architecture makes the malware's "phone home" system effectively impossible to destroy using traditional takedown methods. It's a significant shift in how sophisticated malware campaigns are being designed — and a preview of a harder future for defenders.
The agency whose job is to tell everyone else how to stay secure online spent six months with its own sensitive credentials sitting in a public GitHub repository, visible to anyone who looked. When a security firm finally flagged it, CISA took over 48 hours to revoke the exposed keys. Now CISA has published a postmortem — and to their credit, it's unusually candid.
Here's what happened. A contractor accidentally published 844 MB of sensitive CISA data to a public GitHub repository called "Private CISA" — a name that turned out to be wishful thinking. Inside were files with names like "importantAWStokens" and "AWS-Workspace-Firefox-Passwords.csv." Those files contained administrative cloud credentials and plaintext passwords for dozens of internal CISA systems. The security firm GitGuardian, which automatically scans public code repositories for exposed secrets, sent nine automated alerts before anyone at CISA responded. It took a journalist getting involved to finally trigger action.
This matters well beyond CISA. The mistakes here are ones that organizations of every size make constantly. Secrets end up in code repositories because developers paste them in during testing and forget to remove them. Automated alerts go ignored because they pile up and no one owns them. And when someone external tries to report a security problem, they get bounced between the wrong contact forms. CISA's own postmortem noted that the agency's internal incident reporting channels "were not well defined," causing the researcher to try multiple avenues before anyone acted. The lesson isn't that CISA is uniquely bad at this — it's that even the organizations most focused on cybersecurity can have embarrassingly basic gaps in practice.
CISA says it is now refining its reporting channels and improving how quickly it can rotate exposed keys. GitGuardian researcher Guillaume Valadon put it bluntly: "Letting nine notification emails go unanswered is how a one-day incident becomes a six-month exposure." For any organization that handles sensitive credentials, the takeaway is concrete — scan your own code repositories for secrets, and make it easy for outsiders to tell you when something is wrong.