{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Wordfence Security News","title":"OMGF Pro Exploited, Oracle Payments Attack & AI Repo Backdoor | Wordfence Security News #14","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/3bea3b6c\"></iframe>","width":"100%","height":180,"duration":638,"description":"OMGF Pro Exploited, Oracle Payments Attack & AI Repo Backdoor | Wordfence Security News #14\n\nThis week in Wordfence Security News:\nOMGF Pro unauthenticated file upload exploited during disclosure: 60,000+ blocked attempts across nearly 8,000 sites, fixed in 5.2.7\nOracle E-Business Suite Payments auth bypass exploited in the wild despite a May patch; Shadowserver tracked around 950 exposed EBS instances\nPTC Windchill and FlexPLM unauthenticated RCE added to CISA KEV on June 25 after attackers deployed JSP web shells\nBlueHammer, the deliberately leaked Microsoft Defender flaw, now flagged by CISA as used in ransomware attacks\nSimpleHelp OIDC signature flaw grants fake technician accounts, dropping the Taskweaver loader and Djinn info stealer\nMozilla 0DIN demo shows a clean GitHub repo tricking Claude Code into fetching a DNS TXT payload and opening a shell\nTimestamps:\n\n0:00 Introduction\n0:48 Active Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload\n3:42 Oracle E-Business Suite Payments Exploited in the Wild\n5:21 PTC Windchill / FlexPLM RCE Added to CISA KEV\n6:21 BlueHammer Microsoft Defender Flaw Used in Ransomware Attacks\n6:57 SimpleHelp Auth Bypass Exploited to Deploy Djinn Stealer\n8:46 Clean GitHub Repo Tricks AI Coding Agents Into Running Malware\n\nStory Links:\nActive Exploitation of OMGF Pro Unauthenticated Arbitrary File Upload During Responsible Disclosure Window.\nOracle E-Business Suite Payments Exploited in the Wild\nPTC Windchill / FlexPLM RCE Added to CISA KEV\nBlueHammer Microsoft Defender Vulnerability Exploited in Ransomware Attacks\nSimpleHelp Auth Bypass Exploited to Deploy Djinn Stealer\nClean GitHub Repo Tricks AI Coding Agents Into Running Malware / Mozilla 0DIN Claude Code Demo\n\nStay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.","thumbnail_url":"https://img.transistorcdn.com/tNZ1BCLBa7hdisGHRggcQKe1fS0BRjNwLU5euMPMXfE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNjZm/M2NiNzczNWQ4MDdh/OTYyMTg5MDQ5ODk3/ODI5ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}