CYBER THREATCAST

Threat actors are actively exploiting CVE-2026-4020 in the Gravity SMTP WordPress plugin to pull unauthenticated system reports that can expose API keys, OAuth tokens, email credentials, and server details. That alert lands alongside CISA-linked warnings on FortiBleed, where reporting says attackers harvested more than 86,000 working credentials for internet-exposed Fortinet VPNs and firewalls, and a fresh Splunk Enterprise flaw, CVE-2026-20253, that is reportedly under active exploitation and can be chained toward unauthenticated remote code execution.

WordPress administrators face a particularly ugly mix of immediate abuse and newly disclosed exposure. Gravity SMTP 2.1.4 and earlier is already being exploited and was fixed in 2.1.5, while Operation Endgame said it disrupted the SocGholish/FakeUpdates ecosystem by taking down 106 servers and domains and cleaning 14,971 infected WordPress sites that had been serving fake browser updates and backdoors. Separately, Avada and Simple File List disclosures add more file-deletion risk for site owners already dealing with mass compromise pressure.

Attackers are also hitting trust boundaries that sit outside classic patch cycles. Microsoft said Crypto Clipper has been active since at least February 2026, spreading through malicious USB shortcut files on Windows to steal seed phrases and hijack wallet transfers, while an Axelar-Secret Network bridge flaw let an attacker mint unbacked assets and drain about $4.67 million before connections were cut. The common problem is familiar: exposed management paths, weak verification logic, and user-trusting workflows are still turning small mistakes into outsized losses.