Australia warns of global campaign targeting vulnerable CMS platforms

Multiple high-impact incidents and vulnerability disclosures were reported: the Australian Cyber Security Centre warns of a global campaign exploiting vulnerable CMS platforms and plugins; a novel prompt‑injection technique dubbed “Ghostcommit” hides instructions in PNG images to trick AI/code‑review agents and exfiltrate secrets; six U‑Boot bootloader vulnerabilities could enable stealthy, persistent firmware attacks; and attackers are actively exploiting a critical authentication bypass in the official Gitea Docker image to impersonate any user. Other notable items include Progress urging on