WordPress malware campaign hides payloads in Steam profiles

Nearly 2,000 WordPress websites were infected with malware that relies on Steam Community profile comments to hide command-and-control (C2) data.
The Next Web

A WordPress plugin sold to 15,000 sites has a flaw that lets anyone create an admin account, and attackers are already using it

CVE-2026-8732 in WP Maps Pro lets unauthenticated attackers create admin accounts on 15,000+ WordPress sites. Wordfence blocked 2,858 attacks in 24 hours.
Searchenginejournal.com

Core Web Vitals: WordPress And Astro Versus Everyone Else

HTTP Archive’s latest Core Web Vitals Technology Report ranks seven content management platforms and offers the surprising insight that page weight and PageSpeed Insights Lighthouse scores do not ...
Morning Overview on MSN

Hackers just hit @antv inside wave 4 of the TeamPCP worm — the same crew that walked off with 3,800 of GitHub’s internal repositories two weeks ago

Sometime in late May 2026, a poisoned update slipped into the @antv family of JavaScript visualization libraries, the ...