This Week in Cybersecurity
Supply-chain compromise was the dominant theme. Two widely deployed WordPress tools were turned against their own users: a trojanized Rank Math PRO build shipped for 11 hours with a self-restoring backdoor, and keys stolen in the TeamUpdraft breach are now being used to push backdoor plugins and create admin accounts through UpdraftCentral. Developers were hit too, as attackers hijacked a maintainer account and swapped the OVHcloud CLI release binaries for secret-stealing malware.
On the perimeter, Palo Alto Networks warned that Qilin and INC ransomware affiliates keep exploiting an already-patched PAN-OS and Prisma Access flaw to bypass MFA and reach vCenter and ESXi. Meanwhile an FBI, German and UK joint advisory put SafePay among the most active ransomware gangs, with 600+ victims since August 2024. Researchers also documented a criminal pointing autonomous Cairn AI agents at more than 1,200 company websites, a glimpse of attack automation that needs almost no operator skill.
The breach ledger was long as well: California is notifying families of 5.7M+ public school students after an assessment contractor lost data, Paradigm Healthcare took nearly a year to notify 970,000 Medi-Cal members, and Zeabur announced it will shut down after its second breach in two months.
Top Stories
Qilin and INC Ransomware Groups Exploit Palo Alto Networks Flaw to Bypass MFA
Palo Alto Networks says ransomware actors keep exploiting CVE-2026-0257 in PAN-OS and Prisma Access to bypass MFA, then pivot to vCenter and ESXi. The flaw is already patched, so this is a patch-latency problem: if you haven't updated, assume the gateway is a target and review authentication logs for unexpected MFA-less sessions.
Rank Math PRO WordPress SEO Plugin Compromised to Backdoor Websites
A compromised Rank Math PRO v3.0.123 build was distributed for about 11 hours, planting a self-restoring backdoor (CVE-2026-111862, CVSS 9.8) on sites where it was activated. Anyone who updated in that window should treat the site as compromised, not just roll the plugin forward, since the backdoor restores itself.
Stolen UpdraftCentral Keys Used to Backdoor WordPress Sites
The TeamUpdraft breach exposed UpdraftCentral connection keys, and attackers are using them to push backdoor plugins and create administrator accounts on connected WordPress sites. Rotate any UpdraftCentral keys and audit your user list and installed plugins for anything you didn't add.
OVHcloud CLI Releases Backdoored on GitHub to Steal Developer Secrets
A hijacked maintainer account let attackers replace the OVHcloud CLI v0.11.0 through v0.15.0 release binaries with malware that steals secrets. If those versions ran on a workstation or CI runner, rotate every credential that machine could reach.
Hackers Use Autonomous AI Agents to Breach Company Websites, Target Over 1,200 Sites
A Chinese-speaking criminal pointed Cairn AI agents at 1,200+ sites using only brief instructions. Exposed control panels let researchers watch, and the success rate was roughly 10%. Low per-site odds across that many targets still add up, and it lowers the skill needed to run a large campaign.
Security Corner
10 new advisories published to the Security Advisories section this week. Two are exploited in the wild and listed in CISA KEV.
CVE-2026-96652 — Plex Media Server SSRF (Exploited in the Wild) Step one of the Plex2Shell chain, which attackers have already used to drop an XMRig miner and a Linux proxy backdoor. Update to 1.43.3.10861 and keep Plex off the open internet. Full advisory →
CVE-2026-106931 — SiteGuard Server Edition OS Command Injection (Exploited in the Wild) CISA added this flaw to KEV. The default-on statistics function yields root or SYSTEM. Update to 8.00 Update 5. Full advisory →
CVE-2026-109432 — Camunda 7 Expression Injection (CVSS 9.8 Critical)
Authenticated users can bypass the ad-hoc query expression restriction via orQueries sub-queries, enabling JUEL injection and remote code execution on Camunda 7.24 and 7.23.
Full advisory →
CVE-2026-111998 — Vanus Event Platform Hardcoded Admin Token (Critical) A fixed Bearer token in Vanus's gateway gRPC proxy gives unauthenticated attackers full cluster-admin access. Full advisory →
CVE-2026-108983 — GeoVision GV-ASManager OS Command Injection (Critical) Unauthenticated OS command injection in the GeoWebServer.exe web server, exploitable over the network. Full advisory →
Also this week:
- CVE-2026-110886 — Insecure deserialization in QuantumCloud's Conversational Forms for ChatBot lets unauthenticated attackers inject PHP objects →
- CVE-2026-109894 — Unauthenticated SQL injection in the Booktics WordPress plugin →
- CVE-2026-111990 — Unauthenticated SQL injection in the Kishan0725 Hospital Management System; vendor unresponsive →
- CVE-2026-111440 — Unsafe reflection in openGauss-connector-jdbc's LogFactory (CVSS 7.0); fixed in 7.0.0-LTS →
- CVE-2026-112025 — light0011 cms never checks CAPTCHA server-side, letting attackers script registration and login →
Quick Takes
- F5 Releases Out-of-Band Patches for Three Critical NGINX Vulnerabilities: Emergency fixes for 11 NGINX flaws, including three critical bugs (CVSS 9.2) allowing unauthenticated DoS or code execution. Read more →
- FBI Says SafePay Ransomware Gang "Among Most Active": Advisory AA26-293A details password guessing, known CVEs and phishing across 600+ victims since 2024. Read more →
- APT28 Breaches NATO Naval Shipbuilder and Defense Firms: The HOOKEDGE backdoor and a new reflective loader let the group dwell for months. Read more →
- ROMULUS ClickFix Platform Delivers LegionLoader: Forescout found a reusable ClickFix delivery panel on six servers, now tied to a Siemens flaw. Read more →
- Siemens Software Center Flaw Exploited by ClickFix Attackers: A DLL sideloading bug (CVE-2026-110936, CVSS 8.4) was used to deploy a remote access trojan. Read more →
- Plex2Shell Flaws Exploited for Crypto Miners and a Linux Proxy Backdoor: Four chained CVEs gave RCE on exposed Plex servers within a day of PoC release. Read more →
- California Warns All Public School Students of Contractor Breach: ETS lost data via an SFTP site between May 22 and September 18, 2026; 5.7M+ students affected. Read more →
- 970,000 Medi-Cal Members Affected by Paradigm Healthcare Breach: The intrusion was detected in October 2025, but notification took nearly a year. Read more →
- Zeabur Shutting Down After Second Breach in Two Months: Plaintext internal credentials exposed 3.2M env-variable records and 321,810 accounts; closing December 31, 2026. Read more →
- 23andMe Successor Settles With California for $6 Million: Chrome Holding Company will pay over data protection failures behind the 2023 breach. Read more →
- EU Cyber Law Won't Force Fixes for Fridge Controllers Hit in French Attack: The Cyber Resilience Act requires reporting but patching only during a manufacturer-defined support period. Read more →
- Nigerian National Sentenced to 8 Years for Tax Business Hacks: Chukwuemeka Amachukwu led a group that phished tax prep firms and filed fraudulent returns seeking $8.4M. Read more →
- Ex-OpenAI Engineer Detained Without Bail: A new filing details WhatsApp contact with a Saudi royal. Read more →
- Microsoft Fixes Classic Outlook Bug That Hid Copilot Buttons: A recurring bug hid Copilot controls after profile data failed to load. Read more →
Upcoming
If you run WordPress, make this week's job an inventory: confirm which sites use Rank Math PRO or UpdraftCentral, check for unfamiliar admin accounts and plugins, and rotate keys where there's any doubt. PAN-OS and Prisma Access admins should confirm the CVE-2026-0257 fix is applied and review logs for MFA bypass, since ransomware crews are already working from it toward vCenter and ESXi. Anyone who installed OVHcloud CLI v0.11.0 through v0.15.0 should rotate credentials from the affected machines. Plex owners should update to 1.43.3.10861 and pull servers off the public internet. We'll follow all of it, including any further fallout from the UpdraftCentral and OVHcloud incidents, in next week's digest.
CosmicBytez Labs — IT & Cybersecurity Intelligence Hub