Tag: WordPress
All articles about WordPress.
Actively exploited
Operation Endgame takes down Gootloader, CastleRAT and StealC servers, recovers 6.4 million victim records
On 12 November 2026 Europol announced the latest Operation Endgame strike. Police and private-sector partners actioned 235 servers and 257 domains used by the Gootloader, CastleRAT and StealC malware and found more than 6 million stolen credentials in the seized infrastructure. The data is going to services that notify victims. Here is what the three malware families do, how to check whether you are a victim, and what WordPress site owners should do.
Actively exploited
WordPress: attackers exploit a flaw in the core update process
Run a WordPress site? CVE-2026-119977 lets an attacker with no account run code on your server while WordPress is updating itself, and CISA says it is being exploited. WordPress fixed it on 28 October 2026 in version 7.1.4 and in security releases for older branches.