Threat actors aren't standing still. |
Today's headlines span AI-powered intrusions, evasive phishing, a WordPress RCE attack chain, and a data breach settlement. Read past newsletters here. |
|
|
|
Here’s what you need to know: |
|
|
|
WordPress RCE Threat Escalates |
Public exploit code is now available for two WordPress vulnerabilities that can be chained for pre-authentication remote code execution on default installations. The wp2shell attack chain affects default WordPress 6.9.x and 7.0.x installations without requiring plugins or custom configurations. |
Although patches are available, public proof-of-concept exploits already demonstrate credential theft, malicious plugin uploads, and RCE.
Verify every WordPress instance has been patched, review logs for suspicious REST API or SQL injection activity, and conduct file integrity checks to identify unauthorized plugins or web shells before threat actors gain a foothold. |
Hugging Face Hit by Autonomous AI Attack |
Attackers breached Hugging Face's production infrastructure by using autonomous AI agents to exploit data-processing vulnerabilities, gaining code execution and stealing credentials.
Hugging Face found no evidence that public-facing models, datasets, or Spaces were modified, and confirmed its software supply chain remains uncompromised. The incident shows how autonomous AI agents can automate reconnaissance and credential theft, reinforcing the need to secure AI development pipelines.
Review every AI workflow that processes untrusted datasets, verify processing workers use least-privilege access with short-lived credentials, and simulate AI-driven attack scenarios to uncover weaknesses before attackers automate them. |
23andMe Pays $18M Over Data Breach |
An $18 million multistate settlement has renewed attention on the 2023 23andMe breach, which exposed data tied to nearly 7 million people.
Although attackers compromised only about 14,000 accounts through credential stuffing, they leveraged the DNA Relatives feature to access profile and ancestry data belonging to millions of genetically connected users. The case highlights why strong authentication and account protections are essential for safeguarding sensitive data that cannot be replaced once exposed.
Require phishing-resistant MFA, block reused passwords where possible, and encourage employees to monitor exposed credentials through trusted breach notification services. |
|
|
|
How confident are you in your AI security controls? |
|
|
|
Yesterday's Pulse Check Results |
What's your biggest browser security concern today? |
|
|
|
Security Tools You Can Use |
|
|
|
Text Salting Slips Past AI Defenses |
More than one million phishing emails have used text salting to evade AI-powered email security while leaving the visible message unchanged.
Barracuda researchers found attackers use hidden HTML and CSS text to make phishing emails appear less suspicious to automated detection systems while luring users with fake retail rewards and gift card offers. |
The campaign highlights how both traditional and AI-based email defenses can be bypassed when they analyze source code instead of the content users actually see.
Test your email gateway with text-salted phishing samples and verify it compares rendered content against the underlying HTML to detect hidden-text evasion before these messages reach employee inboxes. |
Microsoft Challenges Anthropic on AI Security |
Microsoft is reportedly developing Project Perception, an AI security tool that identifies vulnerabilities and recommends fixes as a potential rival to Anthropic's Mythos. If the reports are accurate, Project Perception could reduce costs by routing tasks across AI models.
The reported launch also reflects growing competition among AI security vendors on pricing, governance, enterprise integration, and model capabilities.
Before adopting an AI security platform, evaluate how it handles sensitive data, routes prompts across multiple models, and integrates with existing security workflows to avoid unexpected governance or compliance gaps. |
|
| |
What Happens if Credentials Are Stolen? |
Infostealer malware enables account compromise by stealing usernames, passwords, session tokens, and other credentials that attackers can use to log in as legitimate users. |
How to reduce credential risk: |
-
Adopt Zero Trust principles by continuously verifying users and devices, enforcing least-privilege access, and segmenting critical systems to limit lateral movement if credentials are compromised.
-
Require phishing-resistant MFA and regularly remove unnecessary accounts, stale permissions, and unused service credentials.
- Monitor authentication activity and user behavior to detect credential compromise early.
|
A layered identity security strategy can help organizations reduce credential-related risk while improving visibility into unauthorized access attempts. |
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
|
