MUST READ

Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack

 | 

Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable

 | 

U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog

 | 

Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown

 | 

Cybercriminals Turn GTA VI Leaks Into Malware Bait

 | 

TikTok Settles U.S. Child Privacy Case for $400 Million

 | 

iAuthFlow v2: The $10,000 Phishing Toolkit That Survives Your Password Reset

 | 

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 111

 | 

UK Power Plant Disabled for Four Days by Iran-Linked Hackers, Concurrent with US Water Attacks

 | 

Security Affairs newsletter Round 591 by Pierluigi Paganini – INTERNATIONAL EDITION

 | 

Zero-Click Grok Chat History Theft: Adversa AI Demonstrates Cryptographic Context Injection

 | 

Malware Hijacks Android Car Head Units

 | 

U.S. CISA adds Zimbra Collaboration Suite (ZCS) flaw to its Known Exploited Vulnerabilities catalog

 | 

Your Shredded Visa Card May Still Work at the Checkout

 | 

Six Maximum-Severity Flaws Found in Cisco Products

 | 

GitLab Warns of Active Exploitation of Critical GraphQL Flaw

 | 

Poland's CERT Warns of Active Exploitation of Critical Zimbra Collaboration Suite Flaw

 | 

U.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog

 | 

Cl0p Targets 40+ Organizations Through PTC Windchill Flaw

 | 

Manic: The Android Malware That Exfiltrates Data Even When the Phone Is Offline

 | 

miniOrange SAML WordPress Plugin

Pierluigi Paganini August 25, 2026
Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable

Two CVSS 9.8 miniOrange SAML WordPress plugin auth bypasses were exploited while paid editions never appeared in any vulnerability database. Manual patch required. Two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On WordPress plugin, both rated CVSS 9.8, are under active exploitation. Both CVE-2026-61979 and CVE-2026-15981 allow an unauthenticated attacker to […]

newsletter

Subscribe to my email list and stay
up-to-date!

recent articles

Norway ’s Digital Government Infrastructure Hit by a new DDoS Attack

Cyber warfare / August 25, 2026

Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable

Security / August 25, 2026

U.S. CISA adds maximum-severity Oracle flaw to its Known Exploited Vulnerabilities catalog

Security / August 25, 2026

Fake Minecraft Sites Are Still Spreading WeedHack After C2 Takedown

Malware / August 25, 2026

Cybercriminals Turn GTA VI Leaks Into Malware Bait

Malware / August 24, 2026