Skip to content
HACKTECH

Cyber news digest

What broke, and what we check because of it.

Breaches, exploited vulnerabilities, supply chain compromises and new rules, written up for the people who buy security work, with what each one means for an organisation that runs the same kind of systems. Every item cites at least two sources and was verified against them before publication.

52 items214 cited sourcesLatest item 5 November 2026

Showing 3 items in Web & CMS. Show all 52 items

October 2026

1 item

  • Web & CMS

    Sansec: card skimmer in Convertr's shared analytics script hit Brazilian checkouts

    Sansec reported on 26 October 2026 that a Brazilian Magecart group had appended a card skimmer to the analytics tracker that Convertr, an e-commerce platform running the stores and checkouts of dozens of Brazilian fashion brands, loads on every checkout. The skimmer captured card number, expiry date, CVV, cardholder name and CPF taxpayer number and sent them to 1x0.is. Sansec suspects, but has not confirmed, that the attackers got in through CVE-2026-8467, an unauthenticated code execution flaw reachable through the /storybook endpoint of Convertr's self-hosted Plausible Community Edition 3.0 server, which had not been updated since its 2025 install. Convertr removed the skimmer and patched Plausible on 27 October, Sansec said.

    • Website security audit
    • Web application testing
    • Incident response

August 2026

1 item

  • Web & CMS

    Elementor Pro file upload flaw CVE-2026-32475 exploited from the day it was patched

    Patchstack disclosed CVE-2026-32475 on 19 August 2026, an unauthenticated arbitrary file upload flaw in the Forms module of Elementor Pro 4.2.1 and earlier that lets an attacker write a PHP file into the uploads directory and run it. Elementor released the fix in version 4.2.2 the same day. BleepingComputer reported that Wordfence blocked more than 190,000 exploitation attempts between 19 and 23 August, with attackers placing PHP files in /wp-content/uploads/elementor/forms/ and then requesting them directly to run commands.

    • Website security audit
    • Web application testing
    • Incident response

March 2025

1 item

  • Web & CMS

    Next.js middleware flaw CVE-2025-29927 let a crafted header skip authorisation checks

    On 21 March 2025 the Next.js maintainers published advisory GHSA-f82v-jwr5-mffw for CVE-2025-29927, a critical (CVSS 9.1) flaw that let a request carrying the internal x-middleware-subrequest header skip middleware, and with it any authorisation checks performed there. According to Vercel's postmortem, self-hosted applications using next start with output: 'standalone' were affected, while apps on Vercel, Netlify or Cloudflare Workers and static exports were not. Fixes shipped in 12.3.5, 13.5.9, 14.2.25 and 15.2.3, and Datadog Security Labs later reported low-volume scanning that used known exploit header values.

    • Web application testing
    • Application security audit
    • Website security audit

Run the checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book the scoping callHow incident response works