The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Media Production
Breach intelligence, attack campaigns, and threat reports targeting the Media Production sector.
Explore Other Sectors
Media Production Threat Reports
Critical Elementor Pro Vulnerability Exposes WordPress Sites to Unauthenticated Remote Code Execution
A critical vulnerability (CVE-2026-32475) in Elementor Pro WordPress plugin allowed unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. The flaw, scoring 9.0 CVSS, exploited discrepancies in file validation logic within the Forms module's File Upload field. Attackers could bypass extension blocklists by submitting dual file parts, enabling PHP script uploads to public directories. This affected all plugin versions up to 4.2.1, impacting websites with common form configurations like job applications and support tickets. This incident highlights the growing threat landscape targeting WordPress ecosystems, coinciding with large-scale operations like StopAndProtect that weaponize compromised WordPress sites for malware distribution and command-and-control infrastructure.
1 month ago
Kill Chain
StopAndProtect 2026: A Wake-Up Call for Cybersecurity
In mid-2026, cybersecurity researchers identified a global cybercrime operation named 'StopAndProtect' that exploited nearly 2,000 compromised WordPress websites to distribute malware and steal data. The attackers utilized a multifaceted toolkit, including ransomware, worms, and credential stealers, to infiltrate systems via social engineering tactics like fake CAPTCHA prompts. These compromised sites served as command-and-control servers, facilitating malware deployment and data exfiltration. The operation's reliance on outdated WordPress installations underscores the critical need for regular software updates and robust security practices. This incident highlights the escalating sophistication of ransomware campaigns and the increasing use of legitimate platforms as attack vectors. Organizations must prioritize comprehensive cybersecurity measures, including timely software updates, employee training on social engineering tactics, and adherence to frameworks like NIST's Ransomware Risk Management Profile to mitigate such threats.
1 month ago
Kill Chain
Surge in DDoS Attacks Over 1 Tbps in Q2 2026
In the second quarter of 2026, Cloudflare reported a significant escalation in Distributed Denial-of-Service (DDoS) attacks, mitigating over 800 network-layer incidents exceeding 1 terabit per second (Tbps). This marks a more than fivefold increase from the 130 such attacks recorded in the first quarter. The surge included a record-breaking attack peaking at 31.4 Tbps, orchestrated by the Aisuru/Kimwolf botnet. Despite the rise in massive attacks, the majority remained relatively small and brief, with 96.62% below 50 Mbps and 90.6% concluding within 10 minutes. This trend underscores the evolving threat landscape, where attackers are leveraging increasingly sophisticated methods to launch high-volume DDoS attacks. The shift towards DNS-related and reflection/amplification techniques, along with the targeting of sectors like Media, Production, and Publishing, highlights the need for robust and adaptive cybersecurity measures to mitigate these growing threats.
1 month ago
Kill Chain
BdThemes Plugins Supply-Chain Hack Compromises Over 350,000 WordPress Sites
In August 2026, BdThemes, a developer of premium WordPress plugins, experienced a supply-chain attack where a threat actor compromised their infrastructure. The attacker modified a remote JSON feed used by the Biggopti component to display promotional banners in WordPress admin dashboards. By exploiting a cross-site scripting (XSS) vulnerability introduced in March 2026, the malicious code created rogue administrator accounts and installed a webshell for persistent access. This stealthy attack affected over 350,000 active installations, as BdThemes' flagship Element Pack plugin alone had more than 100,000 active installations. The WordPress Plugins team responded by removing the affected plugins from the directory pending a full review. This incident underscores the growing threat of supply-chain attacks targeting widely-used software components. The exploitation of an XSS vulnerability in a promotional banner highlights the need for rigorous security practices in all aspects of software development and distribution. Organizations must remain vigilant, as similar tactics have been observed in other recent attacks, such as those involving the OptinMonster plugin. ([sansec.io](https://sansec.io/research/optinmonster-supply-chain-attack?utm_source=openai))
1 month ago
Kill Chain
Critical wp2shell WordPress Flaws Exploited to Install Webshells
In July 2026, a critical vulnerability chain known as "wp2shell" (CVE-2026-63030 and CVE-2026-60137) was discovered in WordPress Core, allowing unauthenticated remote code execution. Attackers exploited these flaws to deploy persistent webshells and install malicious plugins on vulnerable servers. The exploit leverages the WordPress REST API's batch-processing feature, enabling code execution without authentication. WordPress addressed the issue in versions 7.0.2, 6.9.5, and 6.8.6, prompting automatic security updates for supported installations. The rapid emergence of proof-of-concept exploits and active exploitation underscores the urgency for organizations to update their WordPress installations promptly. This incident highlights the critical need for timely patch management and vigilant monitoring of web applications to prevent unauthorized access and potential data breaches.
2 months ago
Kill Chain
WP2Shell: Unauthenticated RCE Threatens Millions of WordPress Sites
In July 2026, two critical vulnerabilities in WordPress Core, identified as CVE-2026-60137 and CVE-2026-63030, were disclosed. When exploited together, these flaws, collectively termed 'WP2Shell,' allow unauthenticated remote code execution on default WordPress installations. CVE-2026-60137 is an SQL injection vulnerability in the 'author__not_in' parameter of WP_Query, while CVE-2026-63030 is a REST API batch-route confusion issue. Attackers have rapidly developed and disseminated proof-of-concept exploits, leading to widespread exploitation attempts against millions of WordPress sites worldwide. Organizations are urged to update to the latest WordPress versions immediately to mitigate this threat. ([vulncheck.com](https://www.vulncheck.com/blog/wp2shell?utm_source=openai)) The rapid exploitation of WP2Shell underscores the increasing sophistication and speed of threat actors in leveraging newly disclosed vulnerabilities. This incident highlights the critical importance of timely patching and proactive security measures to protect web assets from emerging threats.
2 months ago
Kill Chain
WordPress wp2shell Vulnerabilities: Immediate Action Required
In July 2026, two critical vulnerabilities in WordPress, identified as CVE-2026-63030 and CVE-2026-60137, collectively termed 'wp2shell,' were disclosed. These flaws enable unauthenticated remote code execution (RCE) on default WordPress installations, allowing attackers to fully compromise affected websites. Exploitation began shortly after public disclosure, with attackers deploying persistent webshells and exfiltrating hashed credentials. The vulnerabilities impact WordPress versions 6.9.0 through 7.0.1, with patches available in versions 6.9.5 and 7.0.2. Organizations are urged to apply these updates promptly to mitigate the risk of exploitation. The rapid exploitation of wp2shell underscores the critical need for timely patch management and robust security measures. With WordPress powering a significant portion of the web, the widespread impact of these vulnerabilities highlights the importance of proactive vulnerability management and continuous monitoring to safeguard digital assets.
2 months ago
Kill Chain
Urgent: Patch Critical WordPress Vulnerabilities CVE-2026-63030 & CVE-2026-60137
In July 2026, two critical vulnerabilities, CVE-2026-63030 and CVE-2026-60137, were discovered in WordPress Core versions 6.8.0 through 7.0.1. These flaws, collectively termed "wp2shell," allow unauthenticated attackers to execute remote code by exploiting a REST API route confusion and an SQL injection vulnerability. The exploitation enables full control over affected WordPress sites, including data access, malicious code installation, and administrative privileges. ([threatprotect.qualys.com](https://threatprotect.qualys.com/2026/07/20/wordpress-wp2shell-vulnerabilities-exploited-in-the-wild-cve-2026-63030-cve-2026-60137/?utm_source=openai)) The widespread use of WordPress, powering over 500 million websites, amplifies the impact of these vulnerabilities. ([threatprotect.qualys.com](https://threatprotect.qualys.com/2026/07/20/wordpress-wp2shell-vulnerabilities-exploited-in-the-wild-cve-2026-63030-cve-2026-60137/?utm_source=openai)) Public proof-of-concept exploits have been released, and active exploitation has been observed in the wild, underscoring the urgency for immediate remediation.
2 months ago
Kill Chain
Urgent: Patch Critical 'wp2shell' Vulnerabilities in WordPress Core
In July 2026, critical vulnerabilities known as 'wp2shell' were discovered in WordPress Core, affecting versions 6.9.x and 7.0.x. These flaws, identified as CVE-2026-63030 and CVE-2026-60137, allow unauthenticated attackers to execute remote code on default WordPress installations without any plugins. The vulnerabilities stem from a REST API batch-route confusion and an SQL injection in the 'author__not_in' parameter of 'WP_Query'. WordPress has released patches in versions 6.9.5 and 7.0.2 to address these issues. The release of public proof-of-concept exploits has heightened the urgency for administrators to update their WordPress installations immediately. Given that WordPress powers over 500 million websites, the potential impact is vast, making prompt patching critical to prevent widespread exploitation.
2 months ago
Kill Chain
Global CMS Exploitation Campaign: Protect Your Website Now
In July 2026, the Australian Cyber Security Centre (ACSC) issued an alert regarding a global exploitation campaign targeting vulnerabilities in content management systems (CMS) and associated plugins. Threat actors are actively scanning websites to deploy webshells, leveraging flaws in platforms such as WordPress, Craft CMS, MaxSite CMS, MetInfo CMS, and Joomla JCE. This campaign has significantly impacted small to medium-sized Australian businesses, leading to service disruptions, credential theft, malware deployment, and potential lateral movement within networks. The ACSC highlighted that the campaign might be supported by artificial intelligence, enabling threat actors to accelerate attacks and scale the exploitation of emerging vulnerabilities. Website administrators are urged to apply the latest security updates, remove unused components, enable automatic updates where possible, and implement additional security measures to mitigate the risk of compromise.
2 months ago
Kill Chain
WP-SHELLSTORM: A Massive Exploitation of WordPress Vulnerabilities
In June 2026, cybersecurity researchers uncovered a large-scale operation named WP-SHELLSTORM, which exploited vulnerabilities in outdated WordPress plugins to compromise thousands of websites. The attackers utilized known flaws, notably in the Breeze caching plugin (CVE-2026-3844), to deploy webshells, granting unauthorized access to affected sites. This operation targeted over 1.4 million domains, with confirmed compromises on approximately 25,195 sites. The exposed server provided insights into the attackers' methods, including automated scanning and exploitation of vulnerable plugins. This incident underscores the critical importance of maintaining up-to-date software and implementing robust security measures. The widespread nature of the attack highlights the persistent threat posed by cybercriminals exploiting known vulnerabilities, emphasizing the need for continuous vigilance and proactive defense strategies in website management.
2 months ago
Kill Chain
Interpol Impersonation Ransomware Targets Small Businesses in 2026
In July 2026, a ransomware campaign targeted small businesses across multiple regions, including the US, Europe, Asia, and the Middle East. Attackers impersonated Interpol officials, sending phishing emails that claimed the recipient's organization was under investigation for suspicious activity. These emails urged recipients to download a password-protected archive from Proton Drive, purportedly containing evidence. Upon opening, the archive delivered a ransomware payload disguised as a video file, encrypting local systems and prompting victims to contact the attackers via the Tox messaging platform to negotiate payment. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/attackers-use-interpol-lure-target-small-businesses?utm_source=openai)) This incident underscores the increasing trend of cybercriminals leveraging social engineering tactics to exploit small businesses, which often lack dedicated cybersecurity resources. The campaign highlights the need for heightened awareness and robust security measures to defend against such deceptive attacks.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports