Google's Product Security team disclosed in a blog post that its internal AI agent, PageBreak, has found more than 500 cross-site scripting vulnerabilities across the company's web applications. The tool, piloted last November and made a full product in January, combines AI analysis with validation to flag exploitable bugs, including a cache poisoning issue on apis.google.com, an XSS flaw on admin.google.com, and insecure handshakes in browser extensions, all of which have reportedly been fixed.
darkreading.com
· 2026-10-06
Patchstack researchers found hackers exploiting stored XSS vulnerabilities in two unrelated WordPress plugins—Ninja Forms (CVE-2026-94504) and WPC Product Bundles for WooCommerce (CVE-2026-93836)—to plant backdoors and create rogue admin accounts. The campaign, first spotted October 4 against WPC Product Bundles users and a day later against Ninja Forms, injects a malicious script from 'imgcdn1[.]com' into order data or form submissions that executes when an administrator views it, installing a fake plugin disguised as 'WP Smart Thumbnails.'
bleepingcomputer.com
· 2026-10-06
Microsoft confirmed it will begin enforcing a Content Security Policy on Entra ID sign-in pages starting mid-October 2026, allowing only scripts hosted on trusted Microsoft CDN domains to run during authentication. The rollout, first announced in November 2025, is expected to complete by late October 2026 and applies automatically without tenant configuration.
bleepingcomputer.com
· 2026-09-30
GoKawiil