{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Wordfence Security News","title":"Kirki & UpdraftPlus Exploits, Miasma Supply Chain Worm & 3 Zero-Days | Wordfence Security News #11","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/78440e32\"></iframe>","width":"100%","height":180,"duration":972,"description":"Kirki & UpdraftPlus Exploited, Miasma Supply Chain Worm & 3 Zero-Days | Wordfence Security News #11\n\nIn this episode of Wordfence Security News:\nKirki's password reset endpoint lets unauthenticated attackers redirect admin reset links to any inbox, enabling full account takeover.\nUpdraftPlus UpdraftCentral auth bypass allows unauthenticated attackers to install plugins and achieve remote code execution on connected sites.\nCheck Point Remote Access VPN zero-day exploited since May 7 lets attackers bypass credentials entirely; one intrusion tied to Qilin ransomware affiliate.\nCisco Catalyst SD-WAN Manager zero-day command injection, chainable with two auth bypasses, lets attackers push rogue config to all edge devices as root.\nChrome 149 patches 429 vulnerabilities - nearly triple the previous record - including 22 critical CVEs, with $208,000 in bounty rewards paid out.\nMiasma supply chain worm hit 113+ GitHub repositories by planting AI coding tool config files that exfiltrate cloud credentials on folder open.\n\nTimestamps:\n\n0:00 Introduction\n0:39 Kirki Password Reset Exploit Goes Live\n2:59 UpdraftPlus UpdraftCentral Auth Bypass to RCE\n6:50 Check Point VPN Zero-Day Exploited by Qilin Ransomware Affiliate\n8:59 Cisco SD-WAN Manager Zero-Day Exploited to Gain Root\n11:20 Chrome 149 Ships Record Browser Security Update\n13:20 Miasma Worm Targets Developer Workflows and AI Coding Tools\n\nStory Links:\n\nKirki Password Reset Exploit Goes Live\nUpdraftPlus UpdraftCentral Auth Bypass to RCE\nCheck Point VPN Zero-Day Exploited by Qilin Ransomware Affiliate\nCisco SD-WAN Manager Zero-Day Exploited to Gain Root\nChrome 149 Ships Record Browser Security Update\nMiasma Worm Targets Developer Workflows and AI Coding Tools\n\nStay informed and secure: get the latest WordPress security news on the Wordfence blog or subscribe to the WordPress Security Newsletter.","thumbnail_url":"https://img.transistorcdn.com/tNZ1BCLBa7hdisGHRggcQKe1fS0BRjNwLU5euMPMXfE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNjZm/M2NiNzczNWQ4MDdh/OTYyMTg5MDQ5ODk3/ODI5ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}