{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Wordfence Security News","title":"The Events Calendar RCE, N-central Takeover & Magento Zero-Day | Wordfence Security News #17","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/ae02a37b\"></iframe>","width":"100%","height":180,"duration":412,"description":"The Events Calendar RCE, N-central Takeover & Magento Zero-Day | Wordfence Security News #17\n\nThis week in Wordfence Security News (Week of September 14, 2026):\nThe Events Calendar patched two critical RCE chains on September 10; Wordfence logged the first exploit attempt 2.2 hours after disclosure.\nWordfence's firewall matched 3,285 requests across 619 sites in four and a half days, 2,103 consistent with exploitation.\nN-able fixed a maximum severity pre-auth RCE in N-central; CISA's federal remediation deadline of September 11 has passed.\nStyleSmuggler hit Adobe Commerce and Magento Open Source on September 4, three days before Adobe's CVSS 10.0 hotfix.\nGitLab patched a critical unauthenticated path traversal on September 10; attackers probed it within 24 hours of disclosure.\nChrome's September 8 update shipped 230 security fixes, including a medium-rated V8 out-of-bounds write exploited in the wild.\nTimestamps:\n\n0:00 Introduction\n0:35 The Events Calendar unauthenticated object injection to RCE\n2:42 N-able N-central pre-authentication RCE\n3:49 StyleSmuggler Adobe Commerce and Magento zero-day\n4:57 GitLab repository Commits API path traversal\n5:38 Chrome/Chromium V8 out-of-bounds write\n\nStory Links:\nThe Events Calendar unauthenticated object injection to RCE\nWordfence Argus identifies two critical unauthenticated RCE chains in The Events Calendar (Wordfence blog)\nN-able N-central pre-authentication RCE\nStyleSmuggler Adobe Commerce and Magento zero-day\nGitLab repository Commits API path traversal\nChrome/Chromium V8 out-of-bounds write\n\nStay informed and secure: get the latest Wordfence Security News on the Wordfence blog or subscribe to the WordPress Security Newsletter.","thumbnail_url":"https://img.transistorcdn.com/tNZ1BCLBa7hdisGHRggcQKe1fS0BRjNwLU5euMPMXfE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNjZm/M2NiNzczNWQ4MDdh/OTYyMTg5MDQ5ODk3/ODI5ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}