ThreatXEd Security

🚨 Five critical flaws in WordPress plugins and themes can lead to site takeover or RCE. The bugs span auth bypass, admin password-reset exposure, privilege escalation, and server-side code execution across GiveWP, Avada, WPMU DEV, TranslatePress, and Pods. Read: https://thehackernews.com/2026/08/five-critical-wordpress-plugin-and.html

⚠️ Next.js patched two critical flaws that can enable unauthenticated RCE. One affects Windows-hosted apps. The other requires AVIF optimization. No exploitation has been reported. Details: https://thehackernews.com/2026/08/nextjs-patches-critical-avif-and.html

‼️ CSS inside webmail can capture passwords and take over accounts. New research demos also show CSS/HTML attack paths across Gmail, Fastmail, Proton Mail, Yahoo Mail, and AOL Mail that can leak tokens, hijack UI actions, or lead to account takeover. See what email CSS can now do: https://thehackernews.com/2026/08/new-css-attacks-can-break-webmail.html

⚡ UPDATE - Coldcard-linked theft estimates have jumped from $70 million to $88.6 million. Galaxy Research says two more suspected sweep waves bring the total to 1,367.05 BTC across 4,585 addresses. The activity appears ongoing, and the third wave may involve a different operator. Read: https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html

🛑 Attackers hijacked Adform’s shared tracking script to swap crypto wallet addresses in users’ browsers. The code could rewrite addresses copied, pasted, or entered into forms while the page remained open. How the adtech supply-chain attack worked: https://thehackernews.com/2026/08/hackers-poison-adform-script-to-swap.html

Congratulations to our Talent Center community members on graduating from the Ethiopian Artificial Intelligence Institute! Your hard work, dedication, and commitment have paid off. We are proud of your achievement and wish you continued success as you apply your knowledge and skills to make a positive impact. Congratulations, graduates! !

1Password Partners with Anthropic to Give Claude Access to Your Credentials 1Password and Anthropic unveiled a «zero-exposure» framework that lets Claude AI agents retrieve credentials from a 1Password vault without the assistant ever seeing the raw values. Authentication happens through a scoped broker; the model receives an authenticated session, not the secret itself. Expect similar patterns from other agent-first stacks as autonomous workflows meet enterprise credential policies. @Cyber_Security_Channel

Today marks a special milestone. Proud to announce that ThreatX has officially graduated from the AI startup center 2026 Startup Incubation Program organized by the Ethiopian Artificial Intelligence Institute. This journey has been filled with learning, challenges, innovation, and growth. Thank you to everyone who supported us along the way. This is not the finish line it’s the beginning of an even bigger journey. Here’s to building technology that creates real impact.

🧩 ThreatXEd Friday Challenge: The Cookie That Trusted Itself You're testing a private portal. Logged in as a regular user, you check your cookies and find session_role, holding the value dXNlcg==. You decode it out of curiosity it just says "user". Here's the twist: there's no signature, no server-side lookup happening. The app appears to trust whatever value sits in that cookie directly, and uses it to decide what you're allowed to see. Your turn: 1️⃣ What class of vulnerability is this and why does encoding a value (instead of encrypting or signing it) fail to protect it? 2️⃣ What would you change in the cookie's value, and what would you expect to happen if the server truly has no additional validation? #FridayChallenge #ThreatXEd

🛑 A newly disclosed, 9-year-old #Linux flaw lets unprivileged users overwrite root-owned files and gain persistent root access. On affected XFS systems, the overwrite survives reboot without changing ownership, permissions, timestamps, or the setuid bit. Read: https://thehackernews.com/2026/07/nine-year-old-refluxfs-linux-flaw-gives.html

🛠 Ato Root's Corner: netcat No interface. No assumptions. Just a raw connection and that's exactly why it matters. Half the "advanced" tools you use are built on this same logic. Swipe to see how nc grabs banners, opens listeners, and becomes a reverse shell 👉 Ato Root's rule: a tool with no opinions can't lie to you. 💬 You run nc -v target.com 22 and get a banner you didn't expect. First move? #ThreatXEd

⛽️🔑 One password. No MFA. Fuel shortages across the entire US East Coast. Let's talk about the Colonial Pipeline hack because it's honestly one of the most humbling breaches in cybersecurity history. No fancy zero-day. No genius malware. Just this: An employee's VPN password had leaked online from a totally different, unrelated breach months earlier. That account wasn't even in daily use anymore, but nobody had switched it off. And here's the part that hurts: there was no MFA on it. So a leaked password alone was enough to walk right in. Once inside, attackers dropped ransomware on the company's IT systems. Colonial couldn't be 100% sure the ransomware hadn't also touched their pipeline control systems so out of caution, they shut the whole pipeline down themselves. Result? Fuel shortages, panic buying, and a $4.4 million ransom paid within hours. The real lesson:

This wasn't a "sophisticated hacker" story. It was an old account nobody cleaned up + one missing security setting. That's it. That's the whole attack.

#ThreatXEd #CyberSecurity

Half-open, fully sneaky. 🤝⚡️ Swipe to see how -sS interrupts the handshake before it completes — and why an IDS still catches it. Quick quiz: you send a SYN, and the target replies with a RST-ACK. Is that port Open, Closed, or Filtered? 🤔 (Hint: SYN-ACK = open, silence = filtered... so what does a RST tell you?) Drop your answer below 👇 no Googling. #ThreatXEd #Nmap #CyberSecurity #EthicalHacking #InfoSec

🛑 THE $10.69 DOMAIN THAT STOPPED A GLOBAL RANSOMWARE PANDEMIC May 2017. WannaCry rips through hospitals, banks, and governments worldwide — in hours. No phishing email needed. No user clicking anything. It just... spread. On its own. The exploit: EternalBlue — a leaked NSA tool — targeting a flaw in Windows' ancient SMBv1 protocol (Port 445). The worm behavior: Once inside one machine, it silently scanned the local network and the internet for other unpatched systems, and infected them instantly. No human interaction required. The twist: A 22-year-old researcher (MalwareTech) dug into the decompiled binary and found something odd — before encrypting anything, the malware pinged one bizarre, unregistered domain: iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com He registered it. Cost: $10.69. The moment that domain went live, WannaCry got a response, assumed it was trapped in a sandbox, and shut itself down. Globally. One connection. One decision. Crisis over. ⚡️ THE THREATXED TAKEAWAY WannaCry didn't spread because it was unstoppable. It spread because organizations left a legacy protocol (SMBv1) exposed to the internet and skipped basic patching. Attack surface reduction isn't advanced theory — it's step one. #ThreatXEd #WannaCry #CyberSecurity #InfoSec

🕥ThreatXEd Friday Challenge: Defeating the "Smart" Rate Limiter 🎯 The Scenario You're testing an admin login panel at /admin/login. The app has a rate limiter: more than 5 failed logins from one IP in 60 seconds → instant HTTP 429 Too Many Requests, connection dropped. You fire up Hydra or Burp Intruder against a weak password list... and get walled on attempt #6. 🔍 The Twist You look closer at the 429 response headers and spot something the app leaks back to you:

X-Forwarded-For: 127.0.0.1

🧠 Think it through 1️⃣ What assumption did the developer make when they wired up the rate-limiter relative to reverse proxies? 2️⃣ How would you manually adjust your brute-force request headers to slip past this limiter — without rotating your public IP? 📣 Your move Drop your conceptual payload logic or Python pseudocode in the comments. No copy-pasted tool syntax — we want to see the structural reasoning behind the bypass.

Most accurate answer gets pinned Monday.

#ThreatXEd#FirdayChallenge

Tools like Responder don't succeed because of complex exploit payloads; they succeed by hijacking built-in fallback protocols that are left enabled by default #ThreatXEd