In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
SecurityWeek weekly roundup covers exploited WordPress Super Forms flaw CVE-2026-14894, a $10M bounty on an Iranian cyber official, InjectEave attacks, and more.
SecurityWeek's weekly roundup aggregates short items across the threat landscape, including Microsoft's report of invisible Unicode tag characters used in financial phishing lures at up to 2.37 million messages per day, and active exploitation of critical WordPress Super Forms plugin flaw CVE-2026-14894 to deploy PHP webshells. Policy items include a $10 million US bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab, a 16-month prison sentence for ex-AT&T employee Kenneth Carter over SIM swaps with nearly $600,000 in intended losses, and the US arraignment of Russian Sergei Anatolyevich Filimonov over credential harvesting. Technical items include InjectEave electromagnetic side-channel attacks tested on 11 devices, an FBI warning on OAuth consent phishing, and VulnCheck's finding that only 202 of 26,153 Anthropic Project Glasswing findings were fixed.
- Attackers exploit CVE-2026-14894 in WordPress Super Forms to upload PHP webshells; update to 6.3.314
- Microsoft: invisible Unicode tag characters used in phishing lures at up to 2.37M messages per day
- US offers $10M bounty for IRGC-CEC Cyber Operations Command lead Amir Yaryab
- VulnCheck: only 202 of 26,153 Project Glasswing findings fixed; Claude rated 91.5% high or critical vs 51.3% by maintainers
- InjectEave EM side-channel attacks recovered private audio and appliance states from 11 tested devices
- CVEs
- CVE-2026-14894
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1566 PhishingT1528 Steal Application Access Token
- Products
- Super FormsProject Glasswing
- Threat actors
- QTFYCyberAv3ngers
- Organizations
- CISAFBIVulnCheckNatto ThoughtsIRGC-CEC
- Countries
- United StatesIranChinaRussia
- AI models
- Claude
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-14894 | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the… | 9.8 | 3% | PoC |
From the original article
3 min read at securityweek.com
Noteworthy stories that might have slipped under the radar: Invisible Unicode slips past phishing filters, US puts $10 million bounty on Iranian cyber official, military ties of Chinese hacking group QTFY. The post In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review appeared first on SecurityWeek.
By SecurityWeek News · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.