14,971 WordPress Sites Cleaned in Global SocGholish Takedown
2026-06-20T08:51:49Z•76e505d7c10deb95698cb77f2b8fd12892c59506e62f460d10a5175e456cbb40
24-billion-recordsCISACVE-2026-20181CVE-2026-20253CVE-2026-42055CVE-2026-42530CVE-2026-50656Cisco-ISEElasticsearchFortiBleedFortinetKnown-Exploited-VulnerabilitiesMicrosoft-DefenderNGINXOperation EndGamePostgreSQL-sidecarSocGholishSplunkWordPressclipboard-stealerclippercrypto-theftdata-leaklaw-enforcementmalware
What happened
A high-impact security roundup: law enforcement’s Operation EndGame disrupted the SocGholish fake-update distribution network (took down 106 servers and cleaned ~14,971 WordPress sites). CISA added a high-severity Splunk Enterprise flaw (CVE-2026-20253, CVSS 9.8) to its Known Exploited Vulnerabilities catalog and urged immediate mitigation. Multiple critical product vulnerabilities were disclosed/patched, including NGINX-related bugs addressed by F5 (CVE-2026-42530, CVE-2026-42055, CVSS ~9.2) and a Cisco ISE command-execution flaw (CVE-2026-20181, CVSS 9.1). Microsoft confirmed a Defender zero
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 76e505d7c10deb95698cb77f2b8fd12892c59506e62f460d10a5175e456cbb40
- Enrichment time
- 2026-06-20T08:51:49Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.