Google AI Releases Elephant-Goldfish Model Plugin for Spec-First Coding
The plugin lets coding agents draft specs with zero-context Goldfish subagents before any code is written.
Stories per day · 30 days
3 RSS
Relatedwordpress4backdoor3rank-math3supply-chain3ai-agents2agents1backuply1chatgpt1codex1coding-tools1cve-2026-1118621cve-2026-939531devops1github1google1gpt-61malware1mcp1
34 stories, newest first · one card per story
Stories tagged #plugin
Rank Math PRO downloads carried a self-restoring backdoor for about 11 hours
Copies fetched from rankmath.com between October 15 20:02 UTC and October 16 07:12 UTC can recreate a hidden backdoor; clean release is 3.0.124.
Malicious Rank Math PRO 3.0.123 packages compromise WordPress sites
Packages fetched from October 15, 20:02 UTC to October 16, 07:12 UTC may be infected; 3.0.124 is clean.
PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads
Some Rank Math SEO PRO 3.0.123 downloads included malware that can backdoor WordPress sites and steal credentials.
Stack Overflow for Agents triples signups with ChatGPT plugin
Stack Overflow says a ChatGPT plugin tripled Stack Overflow for Agents signups overnight.
1
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
Backuply through version 1.5.8 lets subscribers plant SQL that becomes administrator access on restore.
Neckbeard – A DevOps/platform/SRE plugin for your agent
Neckbeard is a DevOps, platform, and SRE plugin intended for AI agents.
llm-openai-decisions 0.1a0
Simon Willison released llm-openai-decisions 0.1a0, a plugin for OpenAI's new Decisions API.
Radisson Hotel Group brings hotel discovery into ChatGPT
Radisson launched a ChatGPT hotel plugin and ads converting about 1.5 times organic search.
llm-mistral 0.16
llm-mistral 0.16 adds LLM CLI support for Mistral reasoning models, including Mistral Large 4.
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
Elementor 4.3.0 and 4.3.1 have a CVSS 8.8 CSRF bug that can create a new administrator account.
llm-typesafe 0.1a0
Simon Willison released llm-typesafe 0.1a0, a plugin for TypeSafe AI's Jev model.
llm-keys-ui 0.1
Simon Willison released llm-keys-ui 0.1, a plugin providing a web UI to store API keys on machines without pasting them into agent sessions.
CVE-2026-27540 WooCommerce Flaw Exploited
Attackers are actively exploiting CVE-2026-27540, a critical arbitrary file-upload flaw in the WooCommerce Wholesale Lead Capture WordPress plugin.
2
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
Compromised Admin Menu Editor Pro update server distributed backdoored plugin versions installing web shells and hidden admin accounts on roughly 1,500 WordPress sites.
3
Boost Engagement with Free Passkeys by Wordfence
Wordfence 9 introduces free passkey support, letting WordPress users log in without passwords and reducing authentication friction.
Hackers target WordPress sites via third-party WooCommerce plugin
Attackers exploit unauthenticated file-upload flaw CVE-2026-27540 in WooCommerce Wholesale Lead Capture plugin to install PHP webshells; Wordfence blocked 100,000+ attacks.
3
WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites
Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.
1
Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover
Two CVSS 9.8 flaws in The Events Calendar WordPress plugin expose 600,000+ sites to unauthenticated RCE and admin takeover.
1
Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin
Attackers are actively exploiting an unauthenticated arbitrary file upload flaw in the WooCommerce Wholesale Lead Capture plugin, enabling PHP backdoors and remote code execution.
2
Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin
Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.
datasette-publish-fly 1.4
Datasette-publish-fly 1.4 sets force_https in fly.toml, fixes a volume detection bug, and adds support for app-scoped Fly deploy tokens.
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Attackers are actively exploiting critical file-upload flaw CVE-2026-32475 in Elementor Pro, hacking WordPress sites; Defiant has blocked over 190,000 exploit attempts since patching.
3
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Attackers are actively exploiting a critical unauthenticated file upload flaw in the Super Forms WordPress plugin to deploy PHP backdoors for RCE.
1