Subscribe
Share
Share
Embed
Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.
[0:00] This week on Wordfence Security News.
[0:02] A hacking crew's own exposed server reveals a mass WordPress backdooring operation.
[0:07] A critical Adobe ColdFusion flaw is exploited within hours of technical details going public.
[0:13] A SharePoint flaw Microsoft rated exploitation less likely is now in CISA's exploited vulnerabilities catalog.
[0:21] A new NetScaler flaw echoes the infamous Citrix Bleed bug.
[0:25] The researcher behind BlueHammer drops a fourth Microsoft Defender zero-day.
[0:30] Researchers describe what they assess may be the first documented ransomware operation carried out
[0:36] by an AI agent. And a decades-old Unix trick fools six of the most popular AI coding assistants.
[0:46] This is Wordfence Security News, I'm Alex Thomas.
[0:52] A mass WordPress hacking crew exposed its own tools, targets, and command history by
[0:58] leaving one of its servers open to the entire internet with no password.
[1:03] A cybercrime crew running a mass WordPress hacking operation made a basic mistake.
[1:08] They left one of their own servers open on the internet, without a password, for roughly
[1:13] three weeks.
[1:15] Researchers at SOCRadar found it on June 11th, the operator's own file storage, sitting there for anyone to browse.
[1:22] Inside were the pieces researchers needed to reconstruct the whole operation.
[1:26] Webshells, exploit scripts, scan results, the operator's own command history, even their command and control settings.
[1:34] Ctrl-Alt-Intel also found the same exposed server through Hunt.io and published its findings on June 22nd,
[1:41] more than two weeks before SOCRadar's report. The researchers kept watching the server
[1:46] over time, and at one point, a chunk of log entries from a specific window disappeared,
[1:52] suggesting the operator noticed they'd been spotted and tried to cover their tracks.
[1:57] The toolkit chained together 27 known vulnerabilities across WordPress,
[2:01] Joomla, and some other platforms, but a handful of WordPress plugin vulnerabilities drove
[2:06] of most of the successful activity.
[2:08] The biggest vulnerability was in a caching plugin called Breeze Cache,
[2:12] the same bug we mentioned in a previous episode,
[2:15] tied that time to a different attacker's infrastructure.
[2:18] This time, it's a separate operation, over 45,000 attempts,
[2:22] with researchers classifying over 17,000 sites as confirmed compromised.
[2:27] The flaw only affects Breeze installs with one specific non-default setting turned on,
[2:32] so most Breeze users were not exposed to that specific exploit path.
[2:37] Next was a plugin called ThemeRex Add-ons,
[2:40] with over 3,000 confirmed shells out of over 46,000 attempts.
[2:45] And here's a good reminder that scale doesn't equal success.
[2:49] A Joomla flaw drew over 561,000 attempts,
[2:53] but produced only 77 validated compromises,
[2:57] with none reaching Ctrl-Alt-Intel's stricter confirmed tier.
[3:01] SOCRadar counted more than 1.4 million target domain entries, but that's not 1.4 million hacked sites.
[3:09] That's how many the operators scanned or attempted across every platform combined.
[3:14] The real compromise numbers are smaller, though still serious.
[3:18] Ctrl-Alt-Intel's team counted over 25,000 sites with confirmed or validated evidence of compromise.
[3:25] SOCRadar, counting active web shells specifically, found more than 5,700 still live.
[3:31] At least some of the webshell tooling wasn't custom built.
[3:34] The main payload was based on a public webshell toolkit,
[3:37] just wrapped in extra layers to dodge detection.
[3:40] Some victims also received vShell,
[3:42] which renames its process to mimic a routine Linux kernel worker thread
[3:47] so it wouldn't stand out to anyone glancing at what's running.
[3:51] Researchers assess with medium to high confidence
[3:53] that whoever's behind this is Chinese or Chinese speaking.
[3:58] That's an assessment, not confirmed proof of exactly who's responsible, and the motive looks financial.
[4:04] SOCRadar describes it as an access brokerage operation, breaking into sites at scale and reselling that access to other criminals.
[4:12] Now, this wasn't a zero-day campaign.
[4:14] The operation relied on known vulnerabilities that already had patches available.
[4:19] If you run Breeze Cache, ThemeRex add-ons, SimpleFileList, or WP File Manager, update now.
[4:26] And if you're on Breeze Cache specifically, check whether that Gravatar setting is turned on,
[4:31] and regardless of which plugins you run, it's worth scanning for web shells directly.
[4:39] A critical ColdFusion flaw went from public technical details to real attack attempts within hours.
[4:46] Adobe ColdFusion has been part of enterprise and government web infrastructure for decades,
[4:50] and when ColdFusion bugs are exposed, attackers tend to move quickly
[4:55] because the servers often sit behind real business applications with direct access to sensitive systems and data.
[5:02] That's what happened again here.
[5:04] Adobe patched a critical ColdFusion flaw on June 30th,
[5:07] and within hours of the technical details becoming public, researchers say attackers were already trying to use it.
[5:14] The bug is a path traversal vulnerability that an unauthenticated attacker can use to reach arbitrary code execution
[5:20] in the context of the ColdFusion service account.
[5:24] Ryan Dewhurst, founder of the Threat Intelligence platform KEVIntel, says an exploitation attempt was recorded within hours of technical details about the flaw becoming public.
[5:35] Before most administrators had a chance to read the advisory, let alone apply the update.
[5:41] CISA added the flaw to its Known Exploited Vulnerabilities catalog on July 7th, giving federal civilian agencies until July 10th to remediate it.
[5:50] If you run ColdFusion, update to the newest release right away, ColdFusion 2025 Update 10 or ColdFusion 2023 Update 21 or later.
[5:59] Beyond patching, you should review web-accessible ColdFusion directories, including the CFIDE directory, for files you don't recognize.
[6:08] Microsoft rated this SharePoint flaw exploitation less likely.
[6:12] CISA now says attackers are using it in the wild.
[6:15] SharePoint Server, the on-premises version companies run for their own internal document sharing and intranets, not the cloud-hosted version, has a flaw that lets someone already logged in, even with the most basic level of access, run their own code on the server.
[6:32] Microsoft fixed it back in May and rated it exploitation less likely.
[6:36] CISA later confirmed that exploitation was occurring and added it to its exploited list on July 1st, giving federal agencies until July 4th to patch.
[6:47] Microsoft later clarified that the CVE had been inadvertently omitted from the original May security updates list, even though its fix had already shipped,
[6:56] which meant a lot of administrators had no real signal to prioritize it on top of Microsoft's own unlikely label.
[7:03] If you run SharePoint Server on-premises, subscription edition 2019 or 2016, confirm the May update is actually installed and audit who has site member access or higher because public reporting says site member permissions are sufficient to exploit it.
[7:21] Citrix Bleed helped fuel ransomware attacks.
[7:23] Now another NetScaler flaw can leak process memory with no account required.
[7:28] Citrix fixed flaws in its NetScaler appliances on June 30th.
[7:32] The most notable of which is a bug that lets someone with no account pull fragments of the appliance's process memory,
[7:39] potentially including sensitive data, right out of an HTTP Response if the appliance is configured as a SAML identity provider.
[7:48] Lupovis, a Threat Intelligence firm, reported exploitation attempts shortly after the vulnerability was publicly disclosed
[7:54] and watchTowr publicly shared details, though that hasn't been independently confirmed yet.
[8:00] But this exact flaw family has a track record.
[8:03] The original Citrix Bleed was used by LockBit ransomware affiliates back in 2023,
[8:08] and Citrix Bleed 2 has since been used for initial access in Anubis ransomware intrusions.
[8:15] If you haven't patched this one yet, we suggest doing it now.
[8:19] The researcher behind BlueHammer has now released four Microsoft Defender Zero Days,
[8:24] and the latest could elevate a local attacker all the way to system.
[8:28] Remember BlueHammer, the Defender flaw we covered a few episodes back that a researcher leaked on purpose as a protest against Microsoft?
[8:36] That same researcher later released a fourth Defender-focused vulnerability disclosure called RoguePlanet,
[8:43] a flaw that lets a local attacker escalate to system privileges, basically the highest level of control a program can have on that machine.
[8:51] Microsoft fixed it in an updated Malware Protection Engine version.
[8:56] NVD reflected the affected version update on July 8th,
[8:59] and Microsoft Defender's update page listed that engine version on July 9th.
[9:04] This final patch appears to close the remaining known patch gap
[9:08] among the researchers' publicly released Defender-focused flaws.
[9:14] Researchers say an AI agent carried out an entire ransomware extortion operation.
[9:19] Then they found one clue that made the case much stranger.
[9:24] Sysdig's threat research team says it observed what it assesses to be the first documented case of agentic ransomware.
[9:32] Sysdig says a human selected the victim, arranged the infrastructure, and obtained the initial access credentials,
[9:39] while an AI agent carried out the intrusion and extortion steps the researchers observed.
[9:44] The entry point was a known flaw in Langflow, the AI development tool we've talked about before on the show.
[9:50] From there, the agent harvested credentials and data on the Langflow host, then accessed a separate production database server using root credentials whose origin Sysdig could not determine.
[10:02] It then encrypted 1,342 configuration items, dropped the original configuration tables, and left a ransom note.
[10:10] Its payloads narrated its own reasoning, and one failed login sequence was corrected successfully in 31 seconds.
[10:18] Now, this is Sysdig's own assessment.
[10:20] Not an independently verified fact. And there's a real history of this exact kind of claim getting
[10:25] debunked. Security firm ESET called something named PromptLock the first AI-powered ransomware
[10:32] last year, before learning about 10 days later that it was an NYU academic research prototype,
[10:39] not a real attack. Sysdig also can't confirm whether the data the ransom note claims was
[10:44] stolen actually was, and that Bitcoin address in the note turns out to be a textbook example address
[10:51] straight out of Bitcoin's own developer documentation, an address with a real
[10:56] transaction history, although it had a zero balance when Sysdig checked it. So Sysdig can't
[11:03] tell whether the model just hallucinated a familiar-looking address from its training data
[11:08] or a real operator was behind it. Either way, keep an eye on this one. If the full story holds up,
[11:14] it's a preview of where ransomware is headed. If parts of it don't, that's interesting too. It means
[11:21] we're starting to see how these AI-driven attacks actually fail, not just how they work. If you run
[11:27] Langflow, patch it and keep it off the open internet. A booby-trapped GitHub repo can trick
[11:32] six popular AI coding assistants into adding an attacker's SSH key using a Unix trick that
[11:38] predates modern AI by decades. This last one continues a thread from a couple episodes back
[11:44] where we covered how a clean-looking GitHub repo could trick an AI coding agent into opening a
[11:50] back door with no malware in sight. This one's a variation on that same idea. Researchers at
[11:56] Wiz found that a booby-trapped repo can disguise what looks like an ordinary settings file. Really,
[12:02] it's a symlink, a kind of file that just points somewhere else on the system. When an AI coding
[12:07] assistant sets up the project and goes to write to that file, it follows the link instead and ends up
[12:14] writing the attacker's own key into the list of keys allowed to log into the machine, sometimes
[12:20] without ever showing the developer a confirmation prompt first. Wiz says the pattern affects six of
[12:26] the most popular AI coding tools including Amazon Q Developer, Claude Code, Augment, Cursor, Google
[12:33] anti-gravity and Windsurf. Vendors are split on how to respond. Several of the affected
[12:39] companies fixed it and treated it as a real vulnerability. Anthropic initially rejected
[12:44] Wiz's report as outside its threat model. Anthropic later told Wiz that a symlink warning
[12:50] had already shipped in February before Wiz submitted the report. Now, this is decades-old
[12:56] Unix behavior being used in a brand new way. The trust boundary problem here predates AI
[13:03] entirely. It's just that agents are now the ones incorrectly handling it.
[13:08] If you're using any of these tools on unfamiliar repos, update them, review the repository before
[13:14] allowing any setup actions, don't let the agent run those steps unsupervised, and inspect the
[13:20] authorized keys file if you may have processed an untrusted repository with an affected version.
[13:27] Links to all the stories we covered today are in the description.
[13:30] Thanks for watching or listening and we'll see you next week on Wordfence Security News.