Critical PHP remote code execution flaws trigger emergency security response
Two vulnerabilities rated CVSS 4.0 at 9.2 could expose PHP-powered websites and servers to remote code execution. Patchstack reports active exploitation, while administrators await an emergency security release scheduled for 14:00 UTC today. The PHP ecosystem is facing an urgent security incident following the disclosure of two
Unauthorized access to CPR database exposes personal data of 8.8 million danish citizens
A major security incident involving Denmark’s Central Person Register (CPR) has resulted in unauthorized access to personal information belonging to approximately 8.8 million registered citizens. According to the Danish CPR administration, the incident occurred after unauthorized individuals exploited a legitimate access channel held by a Danish company
Critical WordPress vulnerability enables unauthenticated path traversal and conditional RCE
A critical security vulnerability in WordPress could allow an unauthenticated attacker to abuse page-template resolution to include a locally accessible PHP file outside the active theme directory, potentially leading to remote code execution (RCE) under specific server and theme configurations. The vulnerability, tracked as CVE-2026-87902 and identified
Chess.com data leak exposes records of 7.3 million users
A large dataset containing information on more than 7.3 million Chess.com users is being shared for free on two data leak forums. The 15.5 GB dataset contains 7,337,395 user records. It includes email addresses, usernames, names, countries, chess ratings, subscription information and internal advertising audience tags. The
Tenda routers found with hidden authentication backdoor allowing full admin access
A newly disclosed security vulnerability affecting multiple Tenda router firmware versions has revealed the presence of a hidden authentication backdoor capable of granting attackers full administrative access without requiring legitimate login credentials. The issue, tracked as CVE-2026-11405, was published by the CERT Coordination Center (CERT/CC) under Vulnerability
30 WordPress plugins compromised, someone planted a backdoor in all of them
The backdoor wasn’t a smash-and-grab. It wasn’t noisy, and it wasn’t rushed. It was planted quietly and left to sit for eight months before anyone flipped the switch. I traced the plugin’s history through 939 quicksave snapshots. The code tells a very specific story if you’re willing
Axios compromised on NPM – Malicious versions deploy cross-platform RAT
A highly sophisticated supply chain attack has struck one of the most widely used JavaScript libraries in the world. Two malicious versions of the popular HTTP client axios—1.14.1 and 0.30.4—were published to npm after a maintainer account was hijacked, introducing a stealthy remote access trojan (RAT) affecting
Anthropic accidentally published Claude Code source via npm source map
According to a Twitter post, the Claude code source code has been leaked via a map file in their npm registry. Claude code source code has been leaked via a map file in their npm registry! Code: https://t.co/jBiMoOzt8G pic.twitter.com/rYo5hbvEj8 — Chaofan Shou (@Fried_rice) March 31, 2026 — An
Notepad++ hijacked by state-sponsored actors
In a sobering reminder that even widely trusted open-source projects can become collateral damage in geopolitical cyber conflict, the Notepad++ project has confirmed a prolonged and highly targeted supply-chain attack that compromised its update delivery infrastructure. The incident, which unfolded quietly over several months in 2025, did
Critical security vulnerability in React Server Components enables unauthenticated RCE
The React Team has disclosed a critical security vulnerability affecting React Server Components that can allow unauthenticated remote code execution on affected servers. The issue is tracked as CVE-2025-55182 and carries a cvss score of 10.0, the highest possible severity rating. Developers using React Server Components are