Websites & Online Stores
WordPress, Drupal, Magento, PHP and web servers: the flaws that take sites over, and keeping a site found and safe.
Fake Gift Card Scams: 1,000+ Incidents Use Walmart, Sephora and MrBeast Branding to Push Surveys and Phone Subscriptions, and What to Do This Week
CTM360 tied fake gift card giveaways to more than 1,000 incidents. No card was delivered in any flow it tested. Here is how the scam works, what Trap 10 is, and what businesses should do this week.
AI Bot Traffic: Cloudflare Says AI Agents Are a Burden for Some Websites, and the Bot Settings to Check This Week
Cloudflare's CEO says some customers see AI agents as a bane to their business. Here is what is confirmed, what is still a claim, and the AI bot settings every website owner should check this week.
Dangling DNS Records: Typos in SPF, MX and DMARC Records Leave 43 US Government Domains Open to Email Spoofing, and How to Check Your Own Domain
Researchers found 43 US government domains whose SPF, MX, DMARC or NS records trust misspelled or expired domains. What is confirmed, what is not, and how to check your own DNS this week.
Rails Vulnerability CVE-2026-66066: One Image Upload Can Leak Server Secrets Through Active Storage and libvips, Now Exploited, and the Fixed Versions to Install
A critical Ruby on Rails flaw, KindaRails2Shell, lets anyone who can upload an image read files and secrets on the server. Patches shipped July 29, attacks were reported in late August, and patching alone does not undo stolen secrets.
CWP Backdoor: CWPdoor Hides Inside the Control Web Panel Web Server and Runs Commands Without Logs, How to Check Your Linux Server
Researchers found CWPdoor, a backdoor hidden in a rebuilt copy of cwpsrv, the web server behind Control Web Panel. It runs attacker commands without leaving access log entries. Here is what is confirmed and how to check your server.
Should AI Write Your Code? Yes, If a Person Reviews It: What the Lovable App Leaks Show About AI-Generated Code
Researchers found Lovable-built apps exposing ID document details and more than 200,000 chat messages to anyone who asked. Here is what is confirmed and what to check in your own AI-built apps this week.
Vibe Coding Security Risks: Lovable Apps Exposed 200,000 Chat Messages, the OWASP Top 10 Mistakes Behind It, and What to Check This Week
Researchers found thousands of apps built with Lovable sending database records to anyone who loads the page, including 200,000 chat messages and passport details. Here is what is confirmed, how it maps to the OWASP Top 10, and what to check.
My App Leaked Data, What Now? App Data Breach Response for the First 72 Hours, After Researchers Found Lovable Apps Exposing ID Details and 200,000 Chat Messages
Researchers found thousands of Lovable-built apps handing database records to anyone who asked. If your app leaks data, here is what to do in the first 72 hours: contain it, find out what left, and work out who must be told.
AI App Security Checklist: What to Check Before You Launch a Lovable or Bolt App, After Researchers Found Passport Data and 200,000 Chat Messages Readable Without a Login
Researchers found Lovable-built apps that let anyone read passport details, 200,000 chat messages and other customer records with no login. Here is the launch checklist to run on your AI-built app first.
