ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Source: Patchstack

7 stories

Sortlatesthotimportance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 4Industry 1Policy & legal 1Tools 1
SeverityAllcritical 0high 3medium 1low 0info 3source: Patchstack ✕

Launching managed CRA Article 14 reporting for open source maintainers

EU Cyber Resilience Act Article 14 reporting obligations begin, requiring 24-hour exploit and incident reports; Patchstack launches managed compliance for open-source maintainers.

Starting 11 September 2026, EU Cyber Resilience Act Article 14 requires manufacturers and open-source stewards to report actively exploited vulnerabilities and severe security incidents to ENISA via the EU Single Reporting Platform, with a 24-hour early warning, 72-hour notification, and final reports within 14 days or one month. Patchstack launched a free managed compliance service, acting as Assigned Representative for open-source maintainers and providing a managed VDP. The obligations apply retroactively to all products available on the European market. Patchstack, which has coordinated over 50% of known WordPress ecosystem vulnerabilities, already serves more than 1,000 open-source projects.

Patchstack · 4d agoPolicy & legal

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP

Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.

Patchstack disclosed an unauthenticated remote code execution vulnerability in the GiveWP WordPress donation plugin. An attacker with no account can execute arbitrary commands on the server of an affected GiveWP site. The full chain is reachable when a site has one published donation form and one active payment gateway, a configuration the researcher describes as a common default.

Patchstack · 18d agoVulnerability

Case study: ManageWP Blocks 11.9M+ Threats in 6 Months with Patchstack

Patchstack case study says ManageWP blocked over 11.9M WordPress threats in six months, with top vulnerabilities weaponized in a median of five hours.

ManageWP reports blocking more than 11.9 million threats across managed WordPress sites in six months using Patchstack's vulnerability data and firewalling. The case study stresses that patching alone cannot close the gap, noting attackers weaponize the most-targeted WordPress vulnerabilities with a median of five hours. The piece is primarily vendor marketing aimed at agencies managing many sites.

Patchstack · 22d agoIndustry

One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin

DigitalOcean researchers reported a critical authentication flaw in miniOrange SAML SSO WordPress plugins, allowing login as WordPress admin across seven editions.

The DigitalOcean security team identified a critical flaw in miniOrange's SAML SSO WordPress plugins that allowed an attacker to authenticate as a WordPress administrator. Patchstack notes the issue spans seven editions of the plugin, all sharing a common slug. The write-up covers root cause analysis by DigitalOcean and vendor follow-up coordinated jointly with Patchstack; no specific CVE id is cited in the text.

Patchstack · 25d agoVulnerability

Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin

Elementor Pro WordPress plugin has an unauthenticated arbitrary file upload flaw in its Forms module allowing remote code execution.

Patchstack disclosed a critical unauthenticated arbitrary file upload vulnerability in the Elementor Pro WordPress plugin that can lead to remote code execution. The flaw is in the Forms module's File Upload field, where the extension check and the file-move step run in two separate loops with inconsistent handling of empty file entries. The writeup describes exploitation via crafted upload submissions; no CVE id or evidence of in-the-wild exploitation is given in the post.

Patchstack · 27d agoVulnerability

FlyWP Adds Proactive Vulnerability Protection with Patchstack

FlyWP integrated Patchstack into its managed WordPress hosting platform via a new FlySecurity Pro add-on for proactive vulnerability protection.

FlyWP, a managed WordPress cloud hosting and server management provider, has integrated Patchstack vulnerability intelligence into its platform. The new FlySecurity Pro add-on gives customers proactive protection against WordPress vulnerabilities from a single dashboard. The announcement is a vendor partnership rather than a new flaw or incident.

Patchstack · 29d agoTools1

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

WordPress 7.0.4 patches an author-level RCE in how uploaded media is handed to ImageMagick.

WordPress maintenance release 7.0.4 includes a security fix that changes how uploaded media is passed to ImageMagick, closing a path that let a logged-in author turn a crafted image upload into remote code execution. Patchstack's analysis explains the flaw as a file-type handling issue where a PNG may not be treated as a PNG. The text does not mention a CVE ID or observed exploitation, but the flaw affects extremely widely deployed software.

Patchstack · Aug 12, 2026Vulnerability