ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “stellarwp”

30 stories

Searchkeywordsmart
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 3Exploit / PoC 1
SeverityAllcritical 0high 4medium 0low 0info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)

CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.

On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.

Web discovery (articles for new exploits & KEV entries) · 8d agoExploit / PoC in the wild 2 sourcesCVE-2026-63030CVE-2026-601371· 1 read

12 Best CWPP Solutions Compared (2026): Features & Pricing

CWPP comparison favors Sysdig for container runtime depth, Prisma Cloud for workload breadth, and Aqua for cloud-native lifecycle security.

An editorial comparison of twelve CWPP solutions covers Trend Micro, Aqua, Prisma Cloud, Illumio, Microsoft Defender for Cloud, Fidelis, CrowdStrike and others, with pricing models and category notes. It names Sysdig (Falco lineage) the leader in Kubernetes/container runtime depth and Prisma Cloud the breadth benchmark across hosts, containers, and serverless. It flags Illumio as microsegmentation and Fidelis as NDR/XDR rather than classic CWPP.

GBHackersupdated · 8h agofirst · 1d agoIndustry 14 sources

Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover

Two CVSS 9.8 flaws in The Events Calendar WordPress plugin expose 600,000+ sites to unauthenticated RCE and admin takeover.

Wordfence Argus discovered CVE-2026-78006 and CVE-2026-78159 (both CVSS 9.8) in StellarWP's The Events Calendar plugin, affecting over 600,000 active installations. CVE-2026-78006 exploits PHP object injection via crafted pending comments to execute OS commands; CVE-2026-78159 abuses a specially prepared array to call WordPress functions, enabling admin password resets and subsequent RCE. Both flaws are unauthenticated and patched in version 6.17.4.1, released after reports on August 21-22, 2026.

Cyber Security Newsupdated · 6h agofirst · 1d agoVulnerability 3 sourcesCVE-2026-78006CVE-2026-78159

FlyWP Adds Proactive Vulnerability Protection with Patchstack

FlyWP integrated Patchstack into its managed WordPress hosting platform via a new FlySecurity Pro add-on for proactive vulnerability protection.

FlyWP, a managed WordPress cloud hosting and server management provider, has integrated Patchstack vulnerability intelligence into its platform. The new FlySecurity Pro add-on gives customers proactive protection against WordPress vulnerabilities from a single dashboard. The announcement is a vendor partnership rather than a new flaw or incident.

Patchstack · Aug 17, 2026Tools1

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Attackers exploit CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload PHP web shells; Wordfence blocked 100,000+ attempts since June 2026.

Wordfence reports active exploitation of CVE-2026-27540 (CVSS 9.8), an unauthenticated arbitrary file upload in the wwlc_file_upload_handler AJAX action of the WooCommerce Wholesale Lead Capture plugin (versions through 2.0.3.1, 6,000+ installs), enabling remote code execution via uploaded PHP web shells. Over 100,000 exploit attempts were blocked since June 2026, including 99 in the last 24 hours, traced to ten listed IP addresses. Separately, two critical flaws (CVE-2026-78159 and CVE-2026-78006) in The Events Calendar, installed on 600,000+ sites, allow unauthenticated RCE and full site takeover via PHP object injection chains. StellarWP patched the affected plugin versions 6.17.3 and 6.17.4 in releases 6.17.3.1 and 6.17.4.1.

The Hacker Newsupdated · 3h agofirst · 12h agoExploit / PoC in the wild 6 sourcesCVE-2026-27540CVE-2026-78159CVE-2026-78006

NCP-ArchPreview Technical Report: Moving towards Latent Space Language Models through Next Concept Prediction

An 8.9B-parameter latent-space language model using next-concept prediction matches OLMo-3-7B pretraining loss with only 51.3% of the training tokens.

NCP-ArchPreview augments next-token prediction with Next Concept Prediction over a product-quantized concept vocabulary built from hidden states, trained jointly end-to-end. The 8.9B model was trained on 5.73T tokens from the Dolma-3 dataset, the largest latent-space language model demonstration to date. It consumes 51.3% of the tokens to reach OLMo-3-7B's final pretraining loss and outperforms it by 2.45 points on the downstream macro-average, including a 5.99-point GSM8K gain. The learned latent space also enables lightweight domain adaptation via a 17M-parameter VQ module and improves speculative drafting accepted length by 4.17%.

Hugging Face daily papers · 7d agoAI research1

Stellar Colosseum: A Many-Agent Harness for Long-Horizon Research in Mathematics and Theoretical Computer Science

Stellar Colosseum, a many-agent harness for long-horizon math and TCS research, solves open problems and reaches 71% on TCS-Bench with Gemini models.

Stellar Colosseum is a model-agnostic harness that allocates inference across long-horizon research in mathematics and theoretical computer science, using strategy exploration, a readiness gate, section-level decomposition, and verifier feedback routing. Integrated into Google Antigravity's Teamwork framework as the Long Proof pattern, it obtains new results on open problems from FOCS and JMLR papers using Gemini 3.1 Pro. On TCS-Bench it achieves 71.0% accuracy with Gemini 3.1 Pro and Gemini 3.7 Flash, and a Codeforces evaluation with Gemini 3.1 Pro solves 218 of 222 problems.

arXiv cs.AI / cs.LG / cs.CL · 2d agoAI research

Metasploit Wrap Up: Lot of summer shells and fit http profiles

Metasploit 6.5 ships 13 new modules including RCEs for SonicWall SMA1000, Ghost CMS, Joomla JCE and Langflow, plus a Linux kernel LPE.

Rapid7's Metasploit wrap-up covers the 6.5 release, which adds 13 new modules, including remote code execution exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and a Pix-for-WooCommerce plugin. The Fragnesia Linux kernel local privilege escalation (CVE-2026-46300) also landed. The release introduces HTTP malleable profiles, MCP functionality, Linux multi-fetch payloads and improved Windows on ARM support.

Rapid7 Blog · Aug 14, 2026ToolsCVE-2026-46300

MaxKernel: Agentic Kernel Generation for TPUs

Researchers open-source MaxKernel, a multi-agent LLM system that generates and optimizes TPU kernels matching expert hand-tuned baselines on JaxBench.

MaxKernel is a multi-agent system offering three paradigms for TPU kernel development: human-in-the-loop collaborative design, a fully autonomous metric/trace-driven optimization loop, and graph-based autonomous search for global exploration. All paradigms draw on a shared pool of specialized sub-agents for planning, implementation, self-debugging, testing, and hardware profiling. Evaluated on JaxBench's 50 diverse TPU kernel tasks and real-world workloads from open-source models, it consistently matches expert hand-tuned baselines. The system is open-sourced via the AI-Hypercomputer GitHub repository.

Hugging Face daily papers · 13d agoAI tools & infra

[AINews] Muse Spark 1.3 matches GPT-5.6-Sol, confirming Meta Superintelligence as the newest Frontier Lab, >90% discount for training

Meta's Muse Spark 1.3 reportedly ranks as the world's #3 model, matching frontier models from OpenAI and Anthropic with planned open weights.

The Latent Space AI News roundup leads with Muse Spark 1.3, promised in Zuckerberg's letter, which ranks #3 worldwide per AAII, is slated for open weights, and uses a pricing model over 90% cheaper when users opt in to training. The issue also covers the rumored Gemini 3.8 Flash launch and analysis arguing OpenAI's rumored looped-transformer 'Astra' architecture is a modest tweak rather than a breakthrough. Additional coverage includes ByteDance Seed's HarnessDev harness-evaluation benchmark, a retrieval-invoked actual-use evaluation method, Stanford's revamped agent engineering curricula, and Photon 2.1 adding TTS models and NVIDIA B200 support.

Latent Space · 13d agoModel release1

Nous Research Adds One-Click Local Model Setup to Hermes Desktop

Nous Research's Hermes Desktop now offers one-click local model setup that reads hardware, picks a fitting quantization, downloads weights, and configures llama.cpp automatically.

Hermes Desktop, the MIT-licensed build of the open-source Hermes Agent, now sets up local models in one click: it reads the machine's hardware, selects a model that fits, downloads weights, and configures the inference runtime. It manages a pinned llama.cpp build with CUDA, Metal, Vulkan, HIP, and CPU backends, and shows green/amber/red memory-fit verdicts per catalog model before download. Quantization floors at 4-bit, and recommended models guarantee at least a 64K context window protected by ordered RAM offload (expert weights first, never the attention cache). It runs on macOS 12+, Windows 10/11, and Linux with no account required for local models.

MarkTechPost · 10d agoAI tools & infra1

VU#308749: Remote Code Execution and Arbitrary File Read Vulnerabilities in Kaltura Servers

Insecure deserialization in Kaltura's legacy HTML5 Player V2 (mwEmbed) allows arbitrary file read and remote code execution; Player V7 is unaffected.

CERT/CC issued VU#308749 for two flaws in Kaltura's HTML5 Player V2 library (mwEmbed/html5lib), both caused by the same insecure deserialization bug. The flaws enable arbitrary file read and remote code execution via the exposed mwEmbedLoader.php endpoint. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases; the currently supported Player V7 is unaffected. No evidence of exploitation was cited.

CERT/CC Vulnerability Notes · 22d agoVulnerability

Kimi K3 (2.8T) at 1 token/s on a MacBook Pro, streamed from four SSDs

A GitHub project streams Moonshot's 2.8T-parameter Kimi K3 from four SSDs to run at 1 token/s on a MacBook Pro.

A GitHub repository (argonautlabsai/deltafin) demonstrates running Moonshot AI's Kimi K3, a 2.8-trillion-parameter model, on a MacBook Pro by streaming its weights from four SSDs at 1 token per second. The project drew 55 points and 22 comments on Hacker News, highlighting consumer-hardware inference for extremely large models.

Hacker News · AI · 7d agoAI tools & infraHN 55↑ · 22 comments

Top 10 Best Cloud Workload Protection (CWPP) Solutions in 2026

Editorial scorecard ranks 2026 cloud workload protection platforms, placing Prisma Cloud first, Sysdig second, and CrowdStrike third on detection quality.

A research-based scorecard rates ten cloud workload protection (CWPP) platforms across runtime depth, container/Kubernetes support, coverage breadth, cloud context, and value. Palo Alto Prisma Cloud leads at 8.9, followed by Sysdig at 8.8 and CrowdStrike at 8.6, with Aqua Security tying CrowdStrike at 8.6. The piece argues agent-versus-agentless is a false choice, with leaders now pairing agentless visibility with eBPF-based runtime sensors. Scores are editorial assessments, not lab benchmarks.

Cyber Security News · 5d agoIndustry1

CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

Apache Storm stores shared dependency jars under predictable Maven-derived blob keys, allowing one tenant to substitute jars other tenants execute.

CVE-2026-82428 affects Apache Storm Client (org.apache.storm:storm-client) versions 3.0.0 before 3.1.0, rated important. Dependency artifacts uploaded with storm jar --artifacts were stored under blob keys derived only from the Maven coordinate, making keys identical and predictable for every cluster user. When a blob already existed, the uploader suppressed the collision, enabling a tenant to substitute dependency jars later executed by other tenants in cross-tenant attacks. Fixed in version 3.1.0.

oss-security · 3d agoVulnerabilityCVE-2026-82428

m-a-p/YuE2-3B — new model trending #30 on Hugging Face

M-A-P released YuE2-3B, an open music generation model that outperforms Suno v5 on WildSongBench and runs locally on a 24GB GPU.

The M-A-P (multimodal-art-projection) team released YuE2-3B, an open-weights music generation model that turns lyrics and a style prompt into full songs with vocals and accompaniment. It uses an AR-NAR Mixture-of-Transformers backbone with symbolic planning and flow matching through a VAE, and supports editable scores (melody and chords, including ABC notation) plus agentic editing workflows. On 192 WildSongBench prompts it reports a SongBench average of 6.9632 (best-of-8) versus 6.8721 for Suno v5, claimed as state of the art among evaluated open and proprietary models. It runs 48 kHz stereo inference locally on a single 24GB NVIDIA GPU without quantization, with companion releases including YuE2-Vae, MERT-v2 encoders, the WildSongBench dataset, and SheetSage2.

Hugging Face trending modelsupdated · 4d agofirst · 6d agoModel release 7 sources1

Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms

Wordfence finds an unauthenticated arbitrary file upload flaw in Gravity Forms (1M+ installs) that can lead to remote code execution.

On August 9, 2026, Wordfence's Argus scanner discovered an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Gravity Forms, estimated at over one million active installations. Attackers can write files with attacker-selected extensions to a public temporary upload directory, potentially enabling remote code execution. The post does not mention a CVE identifier or observed exploitation.

Wordfence · 15d agoVulnerability

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.

SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.

The Hacker News · 8d agoMalware in the wild1

Feyospace-v1: How the Cyber Mercury Seven Trained Frontier Cyber Models

A seven-person independent team trained open-weight agentic cyber models via a data-centric post-training framework, ranking 10th on CyberGym and first at comparable scale.

The paper presents Feyospace-v1, a data-centric post-training framework combining five systems: Choulea (hidden reasoning analysis), SkyReal (teacher-sampling cost reduction), Hongzwang (bypassing teacher API restrictions), PSBreakup (restoring capabilities weakened by model merging), and Kreator (converting expert interventions into trainable reasoning). The data engine builds resettable coding, vulnerability, CTF, kernel-history, full-exploit, firmware, and device-backed environments, retaining only execution-verified and evidence-audited trajectories, yielding 164,269 trajectories for long-context supervised fine-tuning. Three checkpoints improve over their starting models by an average of 23.76% on the full CyberGym suite and 10.49% across pooled CTF suites. As of September 1, 2026, Feyospace-s1 achieves a 63.24% verified success rate, ranks 10th on the official CyberGym leaderboard, and all three checkpoints rank 1st among models at comparable parameter scales.

Hugging Face daily papers · 8d agoAI research

WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...

Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.

CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries) · 9d agoExploit / PoC in the wildCVE-2026-63030CVE-2026-60137

[AINews] Jev: a “System One Model” that only decides/classifies/routes/scores — >100x faster, >200x cheaper than small frontier LLMs

TypeSafe launches Jev, an RLCD-trained decision model claiming 20-200x faster, 40-400x cheaper classification than frontier LLMs, alongside Gemini 3.8 Live and Neon.

TypeSafe's Jev is a 'System One' decision model trained with RLCD, claiming 20-200x faster and 40-400x cheaper classification and routing than frontier LLMs with free output tokens and no hallucinated text. Google launched Gemini 3.8 Live and 3.8 Live Extended Thinking, supporting 97 languages and async tool calls, debuting #1 on Artificial Analysis' speech-to-speech index at 82.6. Periodic Labs' Neon is a ~1T-parameter XRD analysis model trained with RL on proprietary lab data using 1,300 H200s, lifting FrontierXRD success from 2.7% to 55.3% and beating GPT-6 Astra at lower inference cost.

Latent Space · 6h agoModel release

The Frontier AEO Tracker: What Astra Chooses (and every other frontier model, and what you can do about it)

Latent Space launches an AEO tracker scoring 7 frontier models' product recommendations across 161 categories, revealing generational bias flips.

Latent Space built a tracker measuring Answer Engine Optimization by running 6 prompt variations across 7 frontier models with search enabled over 161 product categories, scoring first choices, alternatives, mentions, and anti-recommendations. It found 28 categories with a universally dominant primary choice and observed soft biases, such as models favoring their own lab's coding agents. Analysis of Anthropic's Sol→Astra and Opus→Fable generations showed newer models consulting fewer sources and being less likely to change answers when questions are paraphrased.

Latent Space · 8d agoAI research

3D Point Splatting for mmWave Radar Novel View Synthesis

Researchers propose 3DPS, a differentiable point renderer for mmWave radar novel view synthesis that outperforms optical-NVS baselines by 1.7x-5.2x.

The paper introduces 3D Point Splatting (3DPS), the first differentiable point renderer for radar, derived from the solid-angle form of the radar equation with ITU-R P.2040 material models and complex phasor splatting. On six outdoor ColoRadar scenes it reaches 0.587 mean Pearson correlation on held-out range-azimuth images, between 1.7x and 5.2x the RadarSplat, Radar Fields, and DART baselines. The same optimized scene produces ADC, complex range profile, and RA outputs via standard FFT pipelines, and training takes about 3 minutes per scene on an RTX 4090.

arXiv cs.AI / cs.LG / cs.CL · 6d agoAI research

Case study: ManageWP Blocks 11.9M+ Threats in 6 Months with Patchstack

Patchstack case study says ManageWP blocked over 11.9M WordPress threats in six months, with top vulnerabilities weaponized in a median of five hours.

ManageWP reports blocking more than 11.9 million threats across managed WordPress sites in six months using Patchstack's vulnerability data and firewalling. The case study stresses that patching alone cannot close the gap, noting attackers weaponize the most-targeted WordPress vulnerabilities with a median of five hours. The piece is primarily vendor marketing aimed at agencies managing many sites.

Patchstack · 23d agoIndustry

CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

Unvalidated topology dependency keys in Apache Storm Nimbus 3.0.0 enable cross-tenant blob deletion and cluster denial of service.

CVE-2026-82441 (severity: moderate) affects Apache Storm Nimbus (storm-server) versions 3.0.0 before 3.1.0. Topology submissions carry dependency_jars and dependency_artifacts blobstore key lists that Nimbus never validated on the submission path, yet acted on during cleanup of finished topologies. A malicious submitter could reference arbitrary blobstore keys, causing cross-tenant blob deletion and cluster-wide denial of service.

oss-security · 3d agoVulnerabilityCVE-2026-824411

HYDRA: Quantifying Botnet Resource Thresholds for Efficient Link-Flooding Attacks on LEO Satellite Networks

HYDRA models link-flooding attacks on LEO satellite constellations as botnet minimization, matching prior disruption with 34% fewer bots and 23% less traffic.

HYDRA formulates link-flooding attack variants against LEO constellations such as Starlink and Kuiper as botnet minimization problems, quantifying the smallest bot subset and traffic allocation needed to disrupt communications between targeted geographic areas. Under matched stealth constraints it matches the ICARUS attack's disruption using 34% fewer bots and 23% less aggregate traffic, sustaining over 97% attack success as topology evolves. The framework also evaluates five mitigations, including routing diversification, ingress policing, distance-based constraints, source throttling, and botnet attrition.

arXiv cs.CR · 2d agoResearch

Speculative Decoding in vLLM on AMD GPUs

vLLM benchmarks speculative decoding on AMD Instinct MI300X and MI355X GPUs across five drafting methods including EAGLE-3 and native MTP.

The vLLM project documents draft-and-verify speculative decoding support for AMD GPUs via ROCm, comparing native MTP, Gemma 4 MTP, EAGLE-3, DFlash, and DSpark drafting approaches. Output-token throughput effects varied with drafting method, proposal length, model family, draft checkpoint, workload, and acceptance behavior. The post also covers how to enable each method plus practical tuning and observability considerations.

Hacker News · AI · 9d agoAI tools & infraHN 141↑ · 52 comments1

A revisit of remote Spectre attacks on Cloudflare Workers

Cloudflare details its 2024-2025 reassessment of remote Spectre attacks on Workers, covering new attack primitives and hardened defenses.

Cloudflare reassessed the feasibility of remote Spectre attacks against its Workers serverless infrastructure across 2024 and 2025. The write-up describes new attack primitives including Spectre gadgets, remote timers, and techniques for achieving co-location with victim workloads. It also explains new defenses that further harden Cloudflare Workers against speculative-execution side channels.

Cloudflare Blog · 28d agoResearch

Cloudflare DDoS Threat Report H1 2026: 1 Tbps attacks soar as DNS floods and geopolitical tensions drive a new wave

Cloudflare's H1 2026 report records a 519% surge in hyper-volumetric DDoS attacks, driven by DNS and CLDAP reflection amid geopolitical tensions.

Cloudflare detected a 519% surge in hyper-volumetric DDoS attacks across its network during the first half of 2026. Attack traffic was driven heavily by DNS and CLDAP reflection vectors, with 1 Tbps attacks becoming far more common. The report attributes reshaped attack patterns to major geopolitical conflicts.

Cloudflare Blog · Aug 11, 2026Research

How Cloudflare detects MCP traffic and helps secure it

Cloudflare Gateway now detects Model Context Protocol traffic via protocol-level heuristics to expose shadow MCP usage and enforce approved-server access.

Cloudflare Gateway identifies Model Context Protocol (MCP) requests using protocol-level heuristics. Security teams can use the signal to discover shadow MCP traffic on managed networks, enforce Portal-only access for approved MCP servers, and block direct connections. The updates extend standard gateway and zero-trust controls to AI agent traffic.

Cloudflare Blog · Aug 14, 2026Tools