Australia warns of global campaign targeting vulnerable CMS platforms

A cluster of high-impact security stories: the Australian Cyber Security Centre warned of a global campaign exploiting vulnerable CMS platforms and plugins; researchers demonstrated a new 'Ghostcommit' technique that hides prompt-injection payloads inside PNG images to trick AI code-reviewers and agents into exfiltrating repository secrets; six U-Boot bootloader vulnerabilities were disclosed that could enable stealthy firmware compromise and persistent malware; and multiple actively exploited flaws and supply-chain incidents were reported — including a critical authentication-bypass in the Gt