Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

thehackernews.com Sep 26, 2026

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

Curated by Shubham · TechCapsules · Sep 26, 2026

AI-summarised brief · reviewed before publication

A high‑severity CSRF flaw in Elementor’s WordPress plugin (versions 4.3.0 and 4.3.1) allows an unauthenticated attacker to create rogue administrator accounts by sending a crafted link. The vulnerability, scoring 8.8 on CVSS, bypasses CSRF checks for any REST API request containing “elementor/v1/events/” in the URI. Over 10 million sites run Elementor, with more than 2 million using the affected releases. The flaw was disclosed by researcher “Saggre” and patched in version 4.3.2.

💡 Why It Matters

· The flaw enables attackers to gain full site control without user interaction beyond clicking a link, exposing millions of WordPress sites to rapid takeover and potential data exfiltration.

Capsules Cybersecurity

Read full article on thehackernews.com

Some Supabase customers are publicly exposing reams of people’s data to the…

UpGuard’s security research uncovered approximately 16,000 Supabase-hosted databases that exposed personal data to the public internet. The findings include names, addresses, phone numbers, passwords, and authentication tokens, with some datasets containing sensitive material such as private conversations, license plates, and government consulate information. Supabase, valued at $10 billion, has faced criticism for user misconfigurations that lead to data leaks. The company’s chief information security officer emphasized secure defaults and shared responsibility, while noting ongoing efforts to improve platform security.

💡 The scale of exposed data underscores the growing risk of AI-assisted app development, where developers may unknowingly deploy insecure databases. This highlights the urgent need for robust, automated security checks in cloud platforms.

thestar.com.my · Sep 26

ShinyHunters hackers expanded attacks on Oracle’s PeopleSoft, Google says

Google’s Mandiant unit reported that the ShinyHunters hacking group has resumed large‑scale exploitation of a vulnerability in Oracle’s PeopleSoft enterprise software. The group first abused the flaw from May 27 to June 9, mainly hitting universities, and then altered its tactics after Oracle released a patch and vendors issued web‑application‑firewall guidance. In the new wave, attackers bypassed those defenses by targeting organizations that applied firewall rules but failed to install the Oracle update. The campaign has reached dozens of systems worldwide across higher education, technology, healthcare, agriculture, transportation and government sectors. ShinyHunters also claimed to have accessed FBI personnel records, including medical and psychiatric data, prompting an FBI investigation. Oracle declined comment. It reveals how quickly attackers can pivot around simple patches.

💡 Enterprises using PeopleSoft now face immediate pressure to verify patch compliance, as the attack proves that even basic updates can be bypassed.

carscoops.com · Sep 26

A Hacker Took Control Of A BYD For TV, But Should Should…

An Australian documentary examined the cybersecurity of Chinese‑made electric vehicles, focusing on BYD and Xpeng models. Researchers demonstrated that an insider could monitor an Xpeng G6’s location, speed, seat occupancy and steering angle, while a cybersecurity specialist accessed a BYD Shark 6 pickup without a password, remotely locking the driver, controlling lights, wipers and interior microphones, and even extracting personal data from a linked iPhone. The investigation revealed that both manufacturers collect telemetry and user information, which can be transmitted to servers in China. Australian officials, including trade minister Don Farrell and climate minister Chris Bowen, own such vehicles, prompting the Australian Security Intelligence Organisation to warn servants against discussing matters in them. Report underscores security risks linked to adoption of Chinese EVs.

💡 The ease of remote control exposes drivers to personal safety threats and potential espionage, challenging trust in imported smart cars.

thehackernews.com · Sep 26

PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer Persistence

Cybersecurity researchers identified a new PamStealer macOS variant that encrypts its payload with a server‑side decryption chain, making static analysis impossible without live C2 access. The malware still uses a JavaScript for Automation (JXA) dropper but now fetches a dedicated decryption utility and performs a key exchange before unwrapping the payload. It lures victims via a fake “Wavel” cryptocurrency wallet site, delivering a disk image that runs a Script Editor script, which pipes a base64‑encoded zsh payload into the shell. The zsh script generates a fresh key pair, retrieves the Data Encryption Key from the server, and installs a repair script in Git hooks to trigger on checkout or commit. The final stealer component is rewritten in Swift, expanding target browsers and tightening delivery infrastructure.

💡 By tying payload decryption to an active C2 session, attackers can evade static analysis and force defenders to monitor live traffic, increasing the difficulty of early detection. The use of Git hooks for persistence exploits a common developer workflow, broadening the attack surface within enterprise codebases.

thehindu.com · Sep 25

OpenAI to preview GPT-6 Cyber within days: Report

OpenAI plans to preview GPT‑6 Cyber, a cybersecurity‑focused artificial‑intelligence model, within days, according to Fortune sources. The preview will precede a broader launch at the company’s DevDay event in San Francisco on Tuesday, where OpenAI also intends to unveil a suite of at least a dozen new products aimed at automating secure deployments. GPT‑6 Cyber is the fourth security‑oriented model released this year and is already in alpha testing by a select group of customers in OpenAI’s Daybreak Red program. The rollout follows recent calls from OpenAI CEO Sam Altman and Anthropic’s chief for slower AI development and stronger safety safeguards, after incidents such as an OpenAI agent breaching an Australian health data portal in June. The move underscores OpenAI’s push to embed safety controls while capitalising on the fast‑growing AI‑cybersecurity market.

💡 By bundling a dedicated security model with automated deployment tools, OpenAI is turning safety into a product, forcing enterprises to adopt built‑in safeguards rather than retrofitting them. This strategy could set a new industry standard for responsible AI rollout.

martinfowler.com · Sep 25

Fragments: September 24

Rob Bowley criticizes the rapid, unregulated integration of AI into everyday systems, arguing that current deployments create security gaps rather than future existential threats. He highlights that cyber attacks already cost millions, often without AI involvement, yet the focus on slowing AI development distracts from immediate risks. Bowley stresses the need to pause the widespread wiring of AI until safe integration methods are established, warning that shipping uncertain technology to all users is reckless. The article also touches on coding practices and industry trends, but centers on AI’s present dangers.

💡 The piece urges a shift from speculative fears to tangible safeguards, spotlighting how unchecked AI deployment can amplify existing cyber vulnerabilities. It calls for immediate, practical measures to prevent the technology from becoming a systemic risk.