CVE Tools
Track your stack

Chinese hackers exploit WordPress, Zyxel flaws to steal govt data

BleepingComputerBy Bill Toulas

Reported exploitedWordPressRed HeronZyXEL GS1900 Smart Managed Switches

Our summary

A Chinese-speaking threat actor linked to Red Heron exploited WordPress Core wp2shell flaws CVE-2026-63030 and CVE-2026-60137 to breach organizations, including government targets, and steal database records containing passwords and PII. The campaign also exploited ZyXEL GS1900 Smart Managed Switches flaw CVE-2026-7273 and targeted PAN-OS GlobalProtect, FlowiseAI CVE-2026-56271, Ubiquiti UniFi OS CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, Linux CVE-2022-0847, Gitea CVE-2026-60004, Nuclio CVE-2026-79756, SENAITE LIMS CVE-2026-54569, and Proxmox VE CVE-2023-54391. Organizations should review GreyNoise IoCs and patch exposed systems, as the activity resulted in stolen credentials, device configurations, and sensitive records.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. Help Net SecurityAttacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)CVE-2026-60004, CVE-2026-60137 +2
  2. The Hacker NewsUbiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OSCVE-2026-34908, CVE-2026-34909 +1
  3. Check Point Research29th June – Threat Intelligence ReportCVE-2026-34908, CVE-2026-34909 +1
  4. The Hacker NewsCISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively ExploitedCVE-2026-34908, CVE-2026-34909 +1
  5. BleepingComputerCISA warns of max severity Ubiquiti flaws exploited in attacksCVE-2026-34908, CVE-2026-34909 +1
  6. SecurityWeekCritical Ubiquiti Vulnerabilities in Attackers’ CrosshairsCVE-2026-34908, CVE-2026-34909 +1
  7. Daily CyberSecurity (securityonline.info)CISA Adds Four Exploited UniFi OS and Lantronix Flaws to KEV CatalogCVE-2026-34908, CVE-2026-34909 +1
  8. The Hacker News⚡ Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and MoreCVE-2026-34908, CVE-2026-34909 +1
  9. BleepingComputerCritical UniFi OS bug lets hackers gain root without authenticationCVE-2026-34908, CVE-2026-34909 +1
  10. Bishop FoxPopping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & AnalysisCVE-2026-34908, CVE-2026-34909 +1

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store