ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Script Security plugin”

655 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 198Malware 181Exploit / PoC 71Ransomware 61Threat actor 60Data breach 33Phishing & fraud 16AI safety & security 7Policy & legal 7Industry 6AI tools & infra 4Tools 4Advisory 4Research 2
SeverityAllcritical 232high 235medium 152low 26info 10

Jenkins Security Advisory 2026-09-02

Jenkins releases a security advisory affecting Jenkins Core, update-center2, and 17 plugins including GitLab, SAML, LDAP, Microsoft Entra ID, and Script Security.

Jenkins published its September 2, 2026 security advisory covering Jenkins Core, the update-center2 tool, and 17 plugins, including widely deployed ones such as GitLab, SAML, LDAP, Microsoft Entra ID, Script Security, SonarQube Scanner, and Pipeline: Groovy Libraries. The announcement text does not include CVE identifiers, affected version ranges, or any statement about active exploitation. Jenkins plugin advisories typically bundle fixes for issues like stored XSS, CSRF, and missing permission checks. Administrators running any of the listed components should update them via the Jenkins update center.

Jenkins Security Advisories · 13d agoAdvisory1

Jenkins security advisory (AV26-877)

Canada's Cyber Centre relayed a Jenkins advisory (AV26-877) covering core and numerous plugin vulnerabilities fixed in 2.568.3/2.580.

The Canadian Centre for Cyber Security published advisory AV26-877 for the Jenkins security advisory dated September 2, 2026. Affected products include Jenkins releases other than 2.568.3 and 2.580, plus plugins such as GitLab, LDAP, Microsoft Entra ID, SAML, Script Security, Pipeline Build Step, and others. Administrators are encouraged to review the linked advisory and apply necessary updates.

Canadian Centre for Cyber Security · 12d agoAdvisory

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

Check Point details StopAndProtect: ~2,000 compromised WordPress sites deliver ClickFix fake-CAPTCHA malware toolkit combining ransomware, credential theft, screenshots, and WhatsApp surveillance.

Check Point researcher Jaromír Hořejší reports the campaign begins with ClickFix fake-CAPTCHA prompts that trigger a PowerShell command, then two .NET downloader stages that launch six components: SilentEncryptor, NetworkShareScanner, a VBS spreader, LockScreen, SimpleChatProxy, and SilentDataCollector. Hacked WordPress sites host malware stages, serve C2 commands, and receive exfiltrated logs; the actors installed a self-deleting WordPress plugin enabling arbitrary PHP upload anywhere under the WordPress root. From mid-May to late July 2026 the operators exfiltrated more than 700 archives including screenshots every 30 seconds, keylogger output, and WhatsApp contact data, and opsec failures exposed their Visual Basic automation tooling and lists of nearly 2,000 compromised domains.

The Hacker News · 26d agoThreat actor in the wild