Security Saturday — the vulnerabilities, advisories, and incidents from the past week worth knowing about.

Security

  • Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys (The Hacker News)
    Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 sites. The vulnerability, tracked as CVE-2026-4020 (CVSS score: 5.3), is a medium-severity informatio
  • Friday Squid Blogging: Victims of Unregulated Squid Fishing (Schneier on Security)
    Dolphins, sharks, turtles, and human workers are all victims of unregulated squid fishing fleets. Another news article . As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog
  • Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain (The Hacker News)
    Security researchers at Paradigm Shift have published a working exploit, dubbed usbliter8, that achieves arbitrary code execution inside the SecureROM of Apple's A12 and A13 chips. That code is burned into the silicon at manufacture. No sof
  • Anthropic’s Fable and the State of AI (Schneier on Security)
    On June 9th, Anthropic released its Fable generative AI model. Three days later, the US government classified it as a dangerous munition, and used its export-control authority to prohibit any foreign nationals from accessing it. Unable to d
  • ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm (KrebsOnSecurity)
    For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic linked to advertising fraud, account takeovers, and mass data-scraping efforts. This week, researchers

Enjoying these roundups?
Subscribe for daily follow-ups on AI news, trending open-source tools, and Security Saturdays.
Subscribe free →