WordPress Is Being Actively Exploited Right Now — Plus 570 Windows Fixes
Saturday, July 18, 2026 · 5-minute read
A contractor accidentally posted hundreds of internal CISA credentials — including AWS GovCloud keys — to a public GitHub repository, where they sat for nearly six months. Security firm GitGuardian spotted it and eventually brought in KrebsOnSecurity when CISA ignored nine automated alerts. CISA has now published a frank post-mortem admitting its response was too slow and its reporting channels were unclear — a rare piece of institutional honesty that other organizations should read.
↗ Krebs on SecurityResearchers at Expel have tied the April 2026 breach at DigiCert to a Chinese cybercrime group called GoldenEyeDog. The attackers compromised a support employee's device and used that foothold to steal code-signing certificates meant for DigiCert's customers. Those stolen certificates could be used to make malicious software look trustworthy to Windows and other operating systems.
↗ The Hacker NewsA ransomware attack hit Fairlife, the milk and protein shake brand owned by Coca-Cola, and temporarily shut down dairy production across the United States. Coca-Cola disclosed the incident this week. It's a reminder that cyberattacks increasingly ripple into the physical world — hitting factories and supply chains, not just office computers.
↗ BleepingComputerA new botnet called NadMesh is scanning the internet for popular self-hosted AI tools — things like ComfyUI, Ollama, and Langflow — that teams set up quickly and forget to lock down. When it finds an exposed one, it harvests any cloud credentials stored nearby. The operators' own dashboard reportedly claims over 3,800 unique AWS keys stolen. Researchers at QiAnXin's XLab spotted the campaign in early July.
Attackers are sending convincing fake security alert emails to users of popular password manager services LastPass and Bitwarden. The emails claim there has been suspicious activity on the account and push recipients toward fake login pages designed to steal their master password. If an attacker gets your password manager's master password, they can access every account you have stored inside it.
These two bugs, chained together, let a complete stranger run any code they want on a WordPress website — no account, no plugin, no trick needed. The first bug confuses WordPress's REST API into routing a request the wrong way. The second is a SQL injection in WordPress's core code. Together, they give an attacker full control. A working public proof-of-concept is now online, meaning anyone can attempt this attack today.
Status: Patch available — WordPress 6.9.5 and 7.0.2 were released Friday and are being pushed via forced auto-updates. Check that your site is running one of these versions right now.
OpenSSL trusted whatever length a connecting client claimed its message would be — without waiting to see if the message actually arrived. An attacker can send just 11 bytes and trick the server into reserving up to 131 KB of memory that it will never release until the server restarts. Send that packet enough times and the server runs out of memory and stops working. Okta's red team discovered and named this "HollowByte" flaw, and published full details this week.
Status: Patched in OpenSSL 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21 — all released June 9. Critically, there was no CVE or public advisory when the fix shipped, so many systems will have missed it entirely. Check your OpenSSL version manually.
Microsoft's July 2026 Patch Tuesday fixed 570 vulnerabilities — nearly triple last month's record. Two zero-days are already being used in real attacks. CVE-2026-56155 is a bug in Active Directory Federation Services, and CVE-2026-56164 is in Microsoft SharePoint — both allow an attacker to quietly gain higher-level privileges on a Windows system. A third zero-day (CVE-2026-50661) targets BitLocker and could expose encrypted data to anyone with physical access to the device.
Status: All patched in this week's Windows Update. Run Windows Update now if you haven't already — this batch is too important to delay.
Checkmarx researchers uncovered seven fake npm packages disguised as tools for the popular Vite web development framework. What makes this campaign unusual is how the malware phones home for instructions: instead of using a normal server — which can be shut down — it reads commands from three separate blockchain networks (Tron, Aptos, and Binance Smart Chain). This makes it almost impossible for defenders to cut off communication with the malware. The campaign, called ViteVenom, has been active since at least February 2026 and is designed to steal credentials and files from developers' machines. If you build software and use npm packages, audit your dependencies regularly and install only from trusted, verified sources.
↗ The Hacker NewsCISA — the Cybersecurity and Infrastructure Security Agency, the US government body responsible for defending the country's digital infrastructure — spent roughly six months with its own credentials exposed in a public code repository. The irony is hard to miss. The agency that tells everyone else to lock their doors left its own front door wide open.
Here's what happened. A CISA contractor uploaded 844 MB of sensitive data to a public GitHub repository called "Private CISA." The files included administrative keys to three Amazon GovCloud servers and a spreadsheet of plaintext usernames and passwords for dozens of internal systems. Security firm GitGuardian — which constantly scans public code repositories for exposed secrets — spotted it and sent nine automated alerts. All nine were ignored. GitGuardian eventually contacted journalist Brian Krebs, who escalated it to CISA directly. Even then, it took more than 48 hours to invalidate the exposed keys. CISA's own post-mortem admits that its internal reporting channels were so poorly defined that the researcher couldn't figure out who to tell — and ended up trying emails, a vulnerability disclosure form, and a journalist before anyone acted.
For regular people, this story isn't really about CISA — it's about a failure pattern that happens everywhere. Automated warnings get ignored because inboxes are noisy. Responsibility falls into gaps between teams. And a problem that could have been a one-day fix becomes a six-month exposure. The same dynamic plays out in companies of every size. The fix isn't complicated: someone needs to own the process of responding to external security reports, and that person needs to be reachable through a clearly published channel that isn't also used for product bug reports.
CISA says it is now refining its reporting channels and encouraging organizations to publish security contact information in multiple prominent places — not just a security.txt file, but anywhere a worried researcher might think to look. Watch for whether CISA follows through with concrete published changes, and consider whether your own organization could answer the question: "If someone found our credentials on the internet today, who exactly would they call?"