Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

thehackernews.com ·2h ago

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

We haven't written up this one. The Hacker News has the full story — the link below goes straight to it.

Read the original at thehackernews.com →

More in Tech

Celebrating the brilliant pragmatism of TCP/IP, the wiring of the world

Nothing this old should scale this well. Yet here these words are

2h ago ·theregister.com

Celebrating the brilliant pragmatism of TCP/IP, the wiring of the world

Nothing this old should scale this well. Yet here these words are

2h ago ·theregister.com

VAT Validation vs KYB: What Each Actually Checks

Originally published at vatnode.dev . The version on vatnode.dev is the canonical source — refer to it for the latest content.

VAT validation confirms VAT ID registration status but not business legitimacy
KYB is comprehensive risk/compliance process beyond VAT validation
VAT validation and KYB have limited overlap mainly in identity fields

2h ago ·dev.to

Zod Got Backdoored. Your Lockfile Didn't Save You, Luck Did.

Zod is in roughly every TypeScript codebase you've touched. Last weekend, "Zod 4.6.6 compromised by malware?" hit the front page of Hacker News.

Malicious files found in Zod and standard-schema codebases
Ethereum smart contracts used for remote JavaScript execution
npm's preinstall scanning prevented compromised package release

2h ago ·dev.to

The Apple AirTag 4-pack is somehow still sitting at its Prime Day price — last chance to save $10

Apple's upgraded 2nd-gen AirTag 4-pack is down to $89 on Amazon. Features 1.5x longer Precision Finding range, a 50% louder speaker, and Apple Watch tracking.

2h ago ·mashable.com

Sizing a self-hosted forge: finding Gitea instances before you patch

Sizing a self-hosted forge: finding Gitea instances before you patch Patch management for a self-hosted product starts with a question the vendor cannot answer: how many of these do we run, and which of them face the internet.

Organizations must identify all self-hosted Gitea instances before patching.
Comprehensive inventory of Gitea instances is essential to mitigate potential compromise.

2h ago ·dev.to