New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution

The Hacker News - Sep 18, 2026

WordPress today released patches to fix a new set of vulnerabilities in its core software, one of which could allow a crafted web link, opened by a logged-in administrator, to install a theme from the official WordPress.org directory without anyone clicking Install. The security firm pwn.ai, whose researchers reported the flaw, calls the attack chain Click2Shell. On its own the flaw only

Read full article

MORE NEWS

Step Inside ATM 2026: Take a Virtual Tour of the Show’s Standout Stands

Sep 18, 2026

Step Inside ATM 2026: Take a Virtual Tour of the Show’s Standout Stands

Arabian Travel Market (ATM) 2026 recognised six exhibitors for outstanding stand design, creativity, technology and visitor experience at the Arabian Travel Market (ATM) 2026 Best Stand Awards, taking place this week at Dubai World Trade Centre (DWTC). An independent panel of industry experts judged the Awards, recognising exhibitors that went beyond visual impact to create engaging, functional spaces that support business conversations and bring their brands and destinations to life.

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Sep 18, 2026

Microsoft Patches CVSS 10.0 Azure AI Foundry Flaw Enabling Unauthorized Privilege Escalation

Microsoft has released fixes for a maximum-severity security flaw in Azure AI Foundry that could be exploited to achieve privilege escalation. No customer action is required. The vulnerability, tracked as CVE-2026-85889, carries a CVSS score of 10.0. "Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network,"

Marineland beluga from Niagara Falls, Ont., dies at Spain aquarium, 3rd death after rescue transfer

Sep 18, 2026

Marineland beluga from Niagara Falls, Ont., dies at Spain aquarium, 3rd death after rescue transfer

A beluga in Spain that was part of the massive relocation of animals from the shuttered Marineland park in Niagara Falls, Ont., has died. Two other belugas died within weeks of being moved to the U.S.

Michael Sheen's 'constructive' meeting with first minister over toxic dumping claims

Sep 18, 2026

Michael Sheen's 'constructive' meeting with first minister over toxic dumping claims

Michael Sheen said his meeting with the first minister was "early days but that's really encouraging".

New cat species identified for the 1st time in a century

Sep 18, 2026

New cat species identified for the 1st time in a century

A diminutive wild cat that inhabits Bolivia's cloud forest has been identified as a previously unknown species, marking the first time a new living cat species has been formally named and described in more than a century.

NASA Telescope Helps Scientists Find a New Type of X-ray Object

Sep 18, 2026

NASA Telescope Helps Scientists Find a New Type of X-ray Object

The discovery of “hypersoft” X-ray beacons could help solve some mysteries about the universe.

Have we all been wearing our AirPods wrong? Apple fans claim sporting the wireless earphones upside down and in the opposite ears results in better sound quality

Sep 18, 2026

Have we all been wearing our AirPods wrong? Apple fans claim sporting the wireless earphones upside down and in the opposite ears results in better sound quality

They're some of the most popular earphones in the world. But if you use AirPods, you might want to rethink how you wear them.

An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.

Sep 18, 2026

An Abandoned CDN Domain Was Re-Registered. Thousands of Sites Still Call It.

In July 2025, someone registered a domain that used to belong to a content delivery network.  The CDN had been wound down years earlier, and the domain it served assets from was allowed to expire. What it had not lost were its callers. Thousands of websites, code repositories, and documentation pages still carry hard-coded references to hostnames beneath it.  The new owner holds

Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

Sep 18, 2026

Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents

A flaw in four widely used AI coding agents lets someone who controls a plugin's code repository swap the plugin an agent installs for a malicious one, even when the agent locked that plugin to a specific reviewed version, security firm Air Security said on Thursday. The firm said Anthropic has patched the flaw in Claude Code 2.1.179 and OpenAI in Codex 0.146.0, that GitHub Copilot has no

A.I. Safety Goes Mainstream + a ‘Hard Fork’ Exit AMA

Sep 18, 2026

A.I. Safety Goes Mainstream + a ‘Hard Fork’ Exit AMA

“It has been one of the fastest, most sudden shifts I’ve experienced.”

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Sep 18, 2026

WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage

Cybersecurity researchers have discovered a cluster of 13 npm packages that have been found to deliver a previously undocumented JavaScript stealer codenamed WeaselBiscuit. The new malware family, per OpenSourceMalware, exhibits functional overlaps with two malware strains associated with the Democratic People's Republic of Korea's (DPRK) Contagious Interview campaign: BeaverTail and

Move faster to solve climate challenges, Prince William says

Sep 18, 2026

Move faster to solve climate challenges, Prince William says

The Prince of Wales tells the BBC we need to "accelerate" in finding solutions to climate challenges as Earthshot nominees are unveiled.

RECOMMENDED

Science Thread

Science Thread delivers quality and fascinating science and technology content that matters on a daily basis and makes it go viral.

ABOUT US
Sign Up

Copyright © 2015 - 2026 Science Thread. All Rights Reserved.