Hugging Face Blogpublished Sep 22, 00:00 UTC (5d ago)ingested Sep 22, 06:50 UTC

Jun Kim, oMLX creator and maintainer, joins Hugging Face to support the MLX community

infoThreat actor exploited in the wildimportance 40

AI summary · glm-5.3

An anonymous comment can run code if an admin opens the page, using a crafted link to install a theme and execute commands with admin access. These are stack-based buffer overflow vulnerabilities in CGI of Zyxel…

Three ITEMs discussed security vulnerabilities and exploitation techniques. Comment2Shell allows admin to execute code, Click2Shell installs theme and runs with admin, and V vulnerability in CGI of Zyxel switches.

Comment2Shell: anonymous comment can execute code if a logged-in admin opens page.
Click2Shell: crafted link installs theme and runs code with admin's access.
Vulnerability: stack-based buffer overflow in CGI of Zyxel switches.

Read the original

VendorsMicrosoft Veeam Agent OmegaLite Hugging Face

ProductsWordPress Zynal OmegaLite

Threat actorsScattered Spider LockBit Qwen3-235B

OrganizationsMicrosoft Veeam Agent

CountriesU.S.

AI modelsMLOX

ATT&CK T1566.001 Spearphishing Attachment T1190 Exploit Public-Facing Application T1486 Data Encrypted for Impact

Tags#cyber #exploit #malware #threat-actor #vulnerability

Full article

This source does not provide full text. Read it at huggingface.co.

Jun Kim, oMLX creator and maintainer, joins Hugging Face to support the MLX community

Automattic has a new board after failed attempt to put CEO on leave

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

Red Heron Exploits Critical Gitea Flaw to Steal Repositories and Deploy Linux Rootkit

U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog

Elementor WordPress flaw lets attackers create admin accounts

Wordfence Bug Bounty Program Monthly Report – June 2026

WordPress Comment2Shell Vulnerability Lets Hackers Take Over Sites Through Comments

CISA Adds One Known Exploited Vulnerability to Catalog