The 48-hour period from August 15-16, 2026 saw a significant spike in critical vulnerabilities affecting widely-deployed WordPress plugins, with multiple authentication bypass and remote code execution flaws discovered. Seven ransomware groups launched attacks against organizations spanning healthcare, retail, legal services, and manufacturing sectors, notably including Mexican retail giant SEARS (Grupo Sanborns) by the SpaceBears group. The SiYuan note-taking application disclosed nine critical vulnerabilities (CVSS 9.0-9.8) including multiple stored XSS and RCE vectors, while the WordPress ecosystem faces an urgent patch cycle with six critical-severity plugin vulnerabilities enabling authentication bypass and account takeover. Infrastructure remains under sustained pressure from Mozi and Mirai botnet variants, with 50 new malware distribution URLs detected targeting IoT devices and routers. The Evooo1Bot malware represents a tactical evolution, converting compromised gateway devices into SOCKS5 proxy nodes for traffic relay operations.
Six critical-severity vulnerabilities (CVSS 9.8) in popular WordPress plugins enable authentication bypass and account takeover attacks, requiring immediate patching.
The Pods plugin (versions ≤3.3.9) contains a critical authorization bypass in the pods_admin AJAX router that allows unauthenticated attackers to escalate privileges. The vulnerability exists because every access check, including method allowlists and nonce verification, is bypassed.
User Profile Builder plugin (≤3.16.4) vulnerable to authentication bypass due to type confusion. The wppb_log_in_user() function calls absint() on wp_insert_user() return values before checking for errors, converting WP_Error objects to integer 1 and allowing arbitrary account authentication.
TrueBooker plugin (≤1.2.6) allows unauthenticated account takeover. The add_front_user_update() AJAX handler accepts arbitrary truebooker_wp_user_id values passed directly to wp_update_user(), enabling attackers to modify any user account including administrators.
User Session Synchronizer plugin (≤1.4.0) contains an authentication bypass in synchronize_session() function hooked on init. The function performs no nonce, capability, or shared-secret verification, allowing attackers to synchronize arbitrary sessions and take over accounts.
6Storage Rentals plugin (≤2.27.0) allows authentication bypass through the six_storage_create_wp_user() AJAX handler registered without nonce, capability, credential, or ownership validation. Unauthenticated attackers can create WordPress accounts with arbitrary privileges.
Link Library plugin (≤7.9.4) vulnerable to arbitrary file deletion due to insufficient path validation in ll_delete_link_fields function. Unauthenticated attackers can delete arbitrary files on the server, potentially including critical WordPress core files.
Nine critical vulnerabilities discovered in SiYuan versions before v3.7.4, including stored XSS with Node.js integration and remote code execution via Go template injection.
SiYuan <v3.7.4 allows remote code execution through the Template calculation operator, which renders user-authored Go templates without sanitization. Attackers can inject malicious HTML and JavaScript that executes in the renderer with full Node.js access (CVSS 9.0).
Three critical stored XSS vulnerabilities in SiYuan <v3.7.4 enable JavaScript execution with Node.js integration: unescaped attribute-view color fields (CVE-2026-73050), database field names in sort menus (CVE-2026-73052), and unicode2Emoji function codepoint output (CVE-2026-73053). All rated CVSS 9.0.
SiYuan <v3.7.4 fails to restrict authentication attempts. CVE-2026-73046 allows unlimited brute-force attempts against workspace access codes via HTTP Basic Auth (CVSS 9.8). CVE-2026-73045 enables brute-force of per-notebook publish passwords without rate limiting (CVSS 7.5).
Sustained Mozi and Mirai botnet activity with 50 new malware distribution URLs detected. New Evooo1Bot variant converts compromised routers into SOCKS5 proxy infrastructure.
Evooo1Bot, a new modular Mirai-based Linux botnet, actively targets internet-facing gateway devices and routers, converting them into SOCKS5 traffic relay nodes. This represents a tactical shift toward using compromised infrastructure for traffic proxying rather than traditional DDoS operations.
Abuse.ch recorded 50 malware distribution URLs during this period, predominantly serving Mozi and Mirai variants targeting MIPS-based IoT devices. Distribution infrastructure spans IP ranges in China (182.x, 110.x, 222.x), India (42.x), South Africa (196.x), Turkey (95.x), and Eastern Europe (185.x).
Seven ransomware groups disclosed attacks against healthcare, retail, legal, and manufacturing targets. Notable victims include Mexican retail giant SEARS and US healthcare provider Interim HealthCare.
SpaceBears ransomware group claimed attack on SEARS (Grupo Sanborns, S.A. de C.V.), a leading Mexican retail company and subsidiary of Grupo Carso owned by the Slim family. SEARS operates two of Mexico's most iconic retail brands and represents a high-profile target in Latin American retail.
Anubis ransomware group targeted Interim HealthCare, a home healthcare agency and medical staffing provider. Healthcare sector attacks continue to pose significant risks to patient data and service continuity.
Barracuda group compromised VR Advogados, a Brazilian law firm, exfiltrating 3,000 client documents including passport information and powers of attorney. Attackers claim the firm violated data storage and confidentiality laws by posting client documents via a Discord server that was subsequently compromised.
Panzer group targeted Alpine Electronics Europe, a distributor of automotive electronics and audio products serving European markets and automotive manufacturers. Represents supply chain risk to automotive sector.
Multiple data breach incidents disclosed across education, election systems, and government sectors, affecting approximately 180,000 individuals at a single university.
Sogang University in South Korea confirmed a cyberattack exposing personal information of approximately 180,000 students, alumni, and staff. The breach compromised data tied to integrated login accounts, representing one of the larger education sector breaches in the reporting period.
Wake County Board of Elections suspended use of a software vendor following a possible cyberattack that exposed poll worker data. No evidence indicates voting machines, ballots, voter registration records, or vote-counting systems were affected. Election infrastructure remains a critical target.
UK Information Commissioner issued a reprimand to ACRO Criminal Records Office for UK GDPR violations (Articles 32(1), 32(1)(b), 32(1)(d)) following a data breach. ACRO provides national police services including criminal record checks, making the breach particularly sensitive.
CRPx0 threat actor escalates operations, listing 47 victims on leak sites after introducing novel social engineering tactics using OnlyFans accounts.
CRPx0 threat actor, which previously gained attention for offering free OnlyFans accounts to lure victims into clicking malware-deploying links, has listed 47 non-paying victims on leak sites (both clearnet and dark web) since launching operations on August 7. The group combines social engineering with data extortion tactics.
CISA released new cybersecurity resources targeting K-12 educational institutions amid ongoing concerns about sector vulnerability.
CISA unveiled new cybersecurity resources specifically designed for K-12 schools and districts. The release follows mixed reporting on ransomware trends in education (one report claims attacks are down in H1 2026, while another characterizes schools as a new cybersecurity battleground). The education sector faces persistent targeting due to limited security resources.
Multiple high-severity vulnerabilities disclosed in Fastify framework, WordPress plugins, and various web applications requiring immediate attention.
Fastify JWT plugin (<10.2.2) contains a vulnerability where per-request verification keys passed to request.jwtVerify({ key }) are silently overridden by global configuration. Applications using different keys per request may inadvertently accept JWTs signed with the global key (CVSS 8.1).
Two vulnerabilities in @fastify/multipart plugin allow temporary file leakage. CVE-2026-19474 affects versions 3.0.0-10.1.1 where client disconnections during part advancement leave temp files. CVE-2026-18549 (versions 5.3.0-10.1.1) occurs when busboy fileSize limits truncate files while streams remain open (both CVSS 7.5).
Templately plugin for WordPress (≤3.7.1) vulnerable to RCE through fetch_remote_file function. Filename validation/destination mismatch in file handling enables authenticated attackers to upload malicious files and execute arbitrary code (CVSS 8.8).
These briefings are compiled from publicly available threat-intelligence feeds, which may include CISA KEV, NIST NVD, the GitHub Advisory Database (OSV), abuse.ch, and Wordfence Intelligence. Data-breach and credential-leak items may include data from Have I Been Pwned and ransomware.live.
CVE® is a registered trademark of The MITRE Corporation. CVE Records are © The MITRE Corporation, reproduced under the CVE Program Terms of Use. WordPress vulnerability data is provided by Wordfence Intelligence, © Defiant, Inc. Breach data from Have I Been Pwned is licensed under CC BY 4.0.