Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
2026-06-21T01:24:08Z•a5881c993fdcdac16dfaf797ea5504bc22a5b86922190ebaa180e3b058e77a38
AI agent exploitationAPI keysApple A12/A13AutoJackCISAFortiBleedFortinet/FortiGateGentleKillerGravity SMTPJetBrains pluginsJoomla JCEMicrosoft DefenderNGINXRaaSSecureROMWordPressinformation disclosurenpmransomwareremote code executionsupply chain compromiseunpatchable exploitusbliter8
What happened
A range of high-impact active threats and disclosed vulnerabilities were reported: attackers are exploiting an information-disclosure bug in the Gravity SMTP WordPress plugin (CVE-2026-4020) to steal API keys; researchers published an unpatchable SecureROM exploit (usbliter8) affecting Apple A12/A13 devices; F5/NGINX and Apple released patches for critical RCE and Bluetooth authorization flaws (including CVE-2026-42530 and CVE-2025-20701); Microsoft confirmed a Defender elevation-of-privilege zero-day (CVE-2026-50656) with a patch in development; CISA added a Joomla JCE PHP code-execution flaw
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- a5881c993fdcdac16dfaf797ea5504bc22a5b86922190ebaa180e3b058e77a38
- Enrichment time
- 2026-06-21T01:24:08Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.