Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.
Wordfence Argus Finds Ghostscript RCE, Jira Leak & Crypto-Mining Hacks | Wordfence Security News #20
This week in Wordfence Security News (Week of October 12, 2026):
Wordfence Argus found a critical Ghostscript flaw that lets a crafted PDF run code on servers generating WordPress PDF previews, fixed in Ghostscript 10.08.0.
Critical Atlassian file read flaw in eight self-managed products drew 386 attack attempts from 60 IP addresses after watchTowr published exploit code.
Attackers chained two AhsayCBS backup flaws to gain system-level control, leave hidden access, and install a cryptominer disguised as Microsoft Edge.
Ledger found an LTE implant in tampered wallets sold by CryptoBilis that captured 24-word recovery phrases during setup and sent them over cellular.
Attackers forced refrigeration systems into defrost at more than 500 French stores; CERT-FR now lists Danfoss, Copeland, and Dixell controllers.
Timestamps:
0:00 Introduction
0:42 Wordfence Argus Finds Critical Ghostscript Flaw
3:17 Atlassian File Read Flaw in Eight Self-Managed Products
4:56 AhsayCBS Backup Flaws Exploited
6:49 Ledger Finds LTE Implant in Tampered Wallets
8:26 Refrigeration Defrost Attack at 500+ French Stores
Story Links:
Wordfence Argus finds critical Ghostscript flaw behind WordPress PDF previews (https://www.wordfence.com/blog/2026/10/wordfence-argus-discovers-critical-vulnerability-in-ghostscript-the-program-that-turns-uploaded-pdfs-into-thumbnails-on-your-server)
Atlassian file read flaw in eight self-managed products exploited after public PoC (CVE-2026-21589) (https://www.securityweek.com/atlassian-patches-critical-vulnerability-affecting-8-products)
AhsayCBS backup flaws exploited to drop webshells and a cryptominer (https://www.huntress.com/blog/ahsaycbs-flaws-exploit)
Ledger finds LTE implant in tampered wallets sold by CryptoBilis (https://therecord.media/ledger-cryptocurrency-wallet-implant-theft)
Attackers force refrigeration defrost at 500+ French stores; CERT-FR widens to Copeland and Dixell (https://www.securityweek.com/supermarket-refrigeration-attack-widens-to-copeland-dixell-controllers/)
Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog (https://www.wordfence.com/blog/) or subscribe to the WordPress Security Newsletter (https://www.wordfence.com/subscribe-to-the-wordfence-email-list/).
(00:00) - Introduction
(00:42) - Wordfence Argus Finds Critical Ghostscript Flaw
(03:17) - Atlassian File Read Flaw in Eight Self-Managed Products
(04:56) - AhsayCBS Backup Flaws Exploited
(06:49) - Ledger Finds LTE Implant in Tampered Wallets
(08:26) - Refrigeration Defrost Attack at 500+ French Stores
WordPress Core RCE, PeopleSoft WAF Bypass & Citrix NetScaler Zero-Days | Wordfence Security News #19
This week in Wordfence Security News (Week of September 28, 2026):
Unauthenticated WordPress core file inclusion flaw drew more than 4.27 million requests matching the Wordfence firewall rule.
ShinyHunters resumed mass exploitation of a critical Oracle PeopleSoft flaw, bypassing firewall rules by encoding one character.
Two critical Citrix NetScaler flaws were exploited before Citrix disclosed them on September 27, with a September 30 federal deadline.
Two GitHub Actions compromised in May became reachable again September 16-25 with malicious release tags intact.
Apple patched a CoreGraphics flaw that may have been used in an extremely sophisticated attack on targeted individuals.
Timestamps:
0:00 Introduction
0:40 WordPress core file inclusion: 4.27 million requests captured
3:13 ShinyHunters bypasses WAF rules targeting Oracle PeopleSoft
5:15 Citrix NetScaler flaws exploited - federal deadline September 30
6:37 Compromised GitHub Actions switched back on for over a week
8:04 Apple patches CoreGraphics flaw possibly used in targeted attack
Story Links:
WordPress core file inclusion: 4.27 million requests captured (https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)
Wordfence PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core (https://www.wordfence.com/blog/2026/09/psa-critical-unauthenticated-path-traversal-vulnerability-patched-in-wordpress-core/)
ShinyHunters bypasses WAF rules targeting Oracle PeopleSoft (https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-renewed-mass-exploitation-campaign-targeting-oracle-peoplesoft/)
Citrix NetScaler flaws exploited - federal deadline September 30 (https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772)
Compromised GitHub Actions switched back on for over a week (https://socket.dev/blog/mini-shai-hulud-actions)
Apple patches CoreGraphics flaw possibly used in targeted attack (https://support.apple.com/en-us/100100)
Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog (https://www.wordfence.com/blog/) or subscribe to the WordPress Security Newsletter (https://www.wordfence.com/subscribe-to-the-wordfence-email-list/).
libheif RCE, All-in-One WP Migration SQLi & Exploited Cisco Flaws | Wordfence Security News #18
This week in Wordfence Security News (Week of September 28, 2026):
Wordfence Argus found a critical CVSS 9.8 heap overflow in libheif, the system library that decodes iPhone HEIC photos on Linux servers.
The official WordPress Docker image, Debian 13, Ubuntu 26.04 and Fedora 44 were vulnerable out of the box; the fix landed in libheif 1.23.3.
SQL injection in All-in-One WP Migration and Backup (5 million installs) through 7.109 drew probing against 881 sites; patched in 7.110.
Cisco Secure Email Gateway AsyncOS SQL injection is on CISA's exploited list, with no workaround and a federal deadline that passed September 17.
Sandworm and a Qilin ransomware crew exploited two Cisco Secure Firewall Management Center flaws, including a CVSS 10 auth bypass.
Twitch Enhanced Viewer, with roughly 30,000 Chrome users, forwarded live OAuth session tokens to a third-party bot service; fixed in 85.8.7.
Timestamps:
0:00 Introduction
0:39 Wordfence Argus finds critical libheif flaw (iPhone photo library)
3:18 All-in-One WP Migration and Backup archive restore SQL injection
4:55 Cisco Secure Email Gateway SQL injection
6:34 Cisco Secure Firewall Management Center flaws under active exploitation
8:07 Twitch extension forwarded viewer session tokens to a Russian bot service
Story Links:
Wordfence Argus finds critical libheif flaw (iPhone photo library) (https://www.wordfence.com/blog/2026/09/wordfence-argus-discovers-critical-vulnerability-in-libheif-the-library-that-opens-iphone-photos-on-your-server/)
All-in-One WP Migration and Backup archive restore SQL injection (https://www.wordfence.com/blog/2026/09/5-million-wordpress-sites-affected-by-sql-injection-vulnerability-in-all-in-one-wp-migration-and-backup-wordpress-plugin/)
Cisco Secure Email Gateway SQL injection (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-inj-2bLVGmhX)
Cisco Secure Firewall Management Center flaws under active exploitation (https://blog.talosintelligence.com/fmc-ongoing-exploitation/)
Twitch extension forwarded viewer session tokens to a Russian bot service (https://socket.dev/blog/malicious-twitch-browser-extension)
Stay informed and secure: get the latest Wordfence Security News on the Wordfence blog (https://www.wordfence.com/blog/) or subscribe to the WordPress Security Newsletter (https://www.wordfence.com/subscribe-to-the-wordfence-email-list/).
(00:00) - Introduction
(00:39) - Wordfence Argus finds critical libheif flaw (iPhone photo library)
(03:18) - All-in-One WP Migration and Backup archive restore SQL injection
(04:55) - Cisco Secure Email Gateway SQL injection
(06:30) - Cisco Secure Firewall Management Center flaws under active exploitation
(08:07) - Twitch extension forwarded viewer session tokens to a Russian bot service
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
Apple Podcasts (US)
5.0 / 5
3 ratings
Spotify
5.0 / 5
2 ratings
Contact Wordfence Security News
Guest appearances
Does not typically book guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Wordfence Security News?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
