Understanding CVE-2026-9629 and Its Implications A recent vulnerability identified as CVE-2026-9629 has been discovered in the Canvas plugin for WordPress. This flaw affects versions up to and including 2.5.2. Specifically, it allows authenticated attackers with contributor-level access or higher to exploit vulnerabilities via the 'tag' parameter. This vulnerability enables attackers to inject arbitrary web scripts […]

Critical Vulnerability Detected in FooGallery Plugin The FooGallery plugin for WordPress has been identified with a medium-severity vulnerability that poses a significant threat to server security. This flaw allows authenticated users with minimal access to execute stored cross-site scripting (XSS) attacks using the `custom_attribute_key` shortcode parameter. Overview of the Vulnerability Versions of FooGallery up to […]

Understanding CVE-2026-9629 and Its Implications A recent vulnerability identified as CVE-2026-9629 has been discovered in the Canvas plugin for WordPress. This flaw affects versions up to and including 2.5.2. Specifically, it allows authenticated attackers with contributor-level access or higher to exploit vulnerabilities via the 'tag' parameter. This vulnerability enables attackers to inject arbitrary web scripts […]

Critical Vulnerability Detected in FooGallery Plugin The FooGallery plugin for WordPress has been identified with a medium-severity vulnerability that poses a significant threat to server security. This flaw allows authenticated users with minimal access to execute stored cross-site scripting (XSS) attacks using the `custom_attribute_key` shortcode parameter. Overview of the Vulnerability Versions of FooGallery up to […]

There are things we are not really waiting for, in fact we are looking for a way to bypass or avoid them. Unfortunately, some of them are inevitable just like the Cyber Worldwar, which in fact has already begun. Mentionable acts from history There was a historical milestone on May 12th, 2017 when within only […]

As you know, recently we’ve released multiple security patches for the Drupalgeddon vulnerabilities. The last one was Drupal Remote Code Execution - SA-CORE-2018-004, CVE-2018-7602, patched only 2 days after it was first discovered. We’re very proud of our quick reaction time and would like to share some statistics with you about the attacks that were […]

Where it all began Kevin David Mitnick is one of the most famous hackers. At age 13 Mitnick used dumpster dicing and social engineering to bypass the bus ticketing system in Los Angeles, this way he was able to ride the LA area using unused transfer slips. First big step His first unauthorized access to […]

By now, you are likely aware that on May 25, 2018, a new data privacy law introduced in Europe called the General Data Protection Regulation (GDPR) will go into effect. GDPR govern how businesses collect, use and share personal data and it allows individuals to exercise their legal rights. Of course, we have taken the […]

People can never rest. We thought that after the last serious Drupal vulnerablity finally we can rest, but a new threat came up which is including GPON routers made by Dasan. GPON is a type of Passive Optical Network (PON) used to provide fiber connections. It is being used to provide short haul fiber connections […]

Third critical Drupal vulnerability discovered!!! Those who are running a Drupal website couldn’t have a rest over the past few weeks. This is the third time when Drupal recommends to update these sites. During exploring the previous remote code execution (RCE) vulnerability, the CVE-2018-7600, the team discovered a new RCE vulnerability (CVE-2018-7602). If  you or […]

Our team has attended the CloudFest back in March where during the security panel we have attended a presentation about the importance of security by design an important thing in terms of responsibility and suggested OWASP as a standard to start with. In this blog post we would like to show, why it is important […]

CloudFest 2018 – The Security Panel Attending at Cloudfest (formerly known as WHD.Global) is always the highlight of the year event-wise. Catching up with our partners, having lively debates about new technologies and learning from industry leaders are things we always go for. As our ninjas attended in incognito this time – only as attendees, […]

The beta version of WAF 2.0 is performing much better than we expected. The feedback we’ve been receiving about it is truly fascinating. More and more people are realizing just how powerful this module is. It’s already – effectively protecting – hundreds of servers against SQL injections, XSS attacks, command injections, directory traversal, data leakage and […]

Understanding CVE-2026-9061 and Its Implications for Server Security The recent discovery of CVE-2026-9061 presents serious risks for website operators using the Store Locator WordPress plugin. Versions prior to 1.6.9 contain a vulnerability that allows high-privileged users, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks. This situation underscores the critical importance of robust server […]

Introduction The cybersecurity landscape is constantly evolving. One of the latest threats comes from a critical vulnerability in the Agile Store Locator plugin for WordPress. Known as CVE-2026-9062, this security flaw can allow attackers to exploit your server if not addressed. Understanding this vulnerability can help system administrators and hosting providers strengthen their server security. […]

Understanding CVE-2026-9109: A Threat to Server Security Recently, a vulnerability named CVE-2026-9109 has come to light, significantly impacting the GPTranslate plugin for WordPress. This vulnerability allows unauthenticated attackers to execute stored cross-site scripting (XSS) attacks through REST API endpoints. Given the increasing sophistication of cyber threats, understanding and mitigating such vulnerabilities has never been more […]