ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
2026-06-22T19:24:07Z•19eb5cc40d1ec69e93929d5522d6440e31a25aa3f636d69820e6d31e935c5197
ai-securitybackdoorcredential-theftfortinetheap-overreadinformation-disclosuremalicious-adsmalware-loadermulti-tenantnginxoauth-abuseraasransomwarercerouter-malwaresecureromsquidsupply-chainunpatchable-exploitwordpress
What happened
The Hacker News roundup for 22 Jun 2026 highlights multiple high-impact security events: a supply-chain compromise injecting backdoors into ShapedPlugin WordPress Pro releases; four multi-tenant data-exposure flaws in the Dify agent platform (DifyTap); a 29-year-old Squid heap over-read (Squidbleed) leaking cleartext HTTP requests; and a new OXLOADER campaign delivering CastleStealer via malicious Google Ads. Other notable items include active exploitation of Gravity SMTP (CVE-2026-4020), widespread FortiGate compromises (FortiBleed), F5/NGINX critical RCE patches (including CVE-2026-42530), a
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 19eb5cc40d1ec69e93929d5522d6440e31a25aa3f636d69820e6d31e935c5197
- Enrichment time
- 2026-06-22T19:24:07Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.