Hacker News: Placeholder third-party[.]com Referenced Across 1,700+ Repositories Now Serves Malicious Content https:// thehackernews.com/2026/09/plac eholder-third-partycom-referenced.html # news # IT
CVE-2026-62062 - WordPress Elementor Website Builder plugin CVE ID : CVE-2026-62062 Published : Sept. m.
Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.
Zenity Labs disclosed AgentForger, a critical CSRF vulnerability in OpenAI's ChatGPT Workspace Agents enabling attackers to create autonomous agents within victim accounts. A single phishing link can deploy a rogue agent with access to company data and employee systems.
2: login has no rate limiting, and CAPTCHA runs after the password check. That ordering turns credential correctness into an observable oracle — a correct password returns a different error than a wrong one, so accounts get enumerated without solving a CAPTCHA.
21929v1 Announce Type: new Abstract: Agent skills extend coding agents with task-specific instructions, scripts, and resources, but they also create a trusted instruction channel that can be abused beyond conventional security attacks. This paper studies token amplification through skill injection: an economic resource-abuse threat in which a malicious skill causes an agent to consume substantially more tokens than needed for normal task execution.
Cluster mixes Fairphone Linux phone charging, Middle East defense pact, DOE nuclear projects, and RDP honeypot data with no single story. Reports span consumer hardware, international security, energy policy, and cybersecurity intelligence.