$20 per zero-day is already the WordPress plugin reality
2026-05-22T14:51:45Z•d5d03446a0f8f0ea856e65b429b5f9a69024c27839da0ccc92dc5c575a09f7aa
AI-securityAPI-key-latencyCISADDoSGitLabGoogle API keysKEVKali365KimWolfMCPMFA-bypassMicrosoft-365OAuth-token-theftPhishing-as-a-ServiceProton PassWordPressagentic-AIbotnetcredential-revocationsecrets-managementvulnerability-reportingvulnerability-researchzero-dayzero-trust
What happened
This collection of security news highlights several emergent threats and defensive moves: researchers demonstrated an AI-driven pipeline able to find and validate WordPress plugin zero-days at scale (priced publicly at ~$20 per zero-day); Aikido Security found deleted Google API keys remain valid for up to 23 minutes, risking abuse and data/Gemini access; the FBI warned of Kali365, a Phishing-as-a-Service that captures Microsoft 365/OAuth tokens and can bypass MFA; law enforcement arrested an alleged KimWolf DDoS-for-hire operator; and vendors and vendors’ tooling responded with mitigations or
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- d5d03446a0f8f0ea856e65b429b5f9a69024c27839da0ccc92dc5c575a09f7aa
- Enrichment time
- 2026-05-22T14:51:45Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.