2026-06-07: WordPress site takeovers are spreading via a critical Everest Forms Pro exploit that creates rogue

Show Notes - 2026-06-07 Stories Covered: - 2026-06-07 - Today: - Cisco SD-WAN Zero-Day Under Active Attack (https://www.theregister.com/personal-tech/2026/06/07/uk-exam-watchdog-frets-over-smart-specs-turning-gcses-into-google-searches/5251365) - Critical Everest Forms Pro Flaw Exploited to Take Over WordPress Sites (CVE-2026-3300) (https://www.bleepingcomputer.com/news/security/critical-everest-forms-pro-flaw-exploited-to-take-over-wordpress-sites/) - Exposed Fuel Tank Gauges Under Attack in the US (https://www.darkreading.com/cyberattacks-data-breaches/exposed-fuel-tank-gauges-attack-us) - Adaptive AI Worms Loom as Next Enterprise Threat (https://www.darkreading.com/cyber-risk/adaptive-agentic-ai-worms-enterprise-cyber-threat) - ChatGPT Lockdown Mode Limits Data Exfiltration Tools (https://thehackernews.com/2026/06/new-chatgpt-lockdown-mode-limits-tools.html) - CVE-2026-3300: Everest Forms Pro Unauthenticated RCE (https://www.bleepingcomputer.com/news/security/critical-everest-forms-pro-flaw-exploited-to-take-over-wordpress-sites/) - CVE-2026-50219: libexpat Use-After-Free Vulnerability (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50219) - CVE-2026-8643: pip Path Traversal in Script Installation (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8643) - CVE-2026-7774: Python tarfile Path Traversal Bypass (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-7774) - CVE-2026-11332: Ansible-core Argument Injection in ansible-galaxy (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-11332) - CVE-2026-3276: Python DoS via Quadratic Complexity in unicodedata.normalize() (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-3276) - CVE-2026-43958: RRDtool Stack Buffer Overflow (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-43958) - CVE-2026-10722: cilium eBPF Integer Overflow (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-10722) - CVE-2026-37460: FRRouting BGP DoS Vulnerability (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-37460) - CVE-2026-42504: Go mime Package Quadratic Complexity DoS (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42504) - CVE-2026-42507: Go net/textproto Unescaped Input in Errors (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42507) - CVE-2026-27145: Go Inefficient Hostname Parsing in crypto/x509 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27145) - CVE-2026-8829: Perl HTML::Entities Use-After-Free (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-8829) - CVE-2026-5419: GnuTLS Timing Side-Channel in PKCS#7 Padding (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-5419) - Opal Security Raises $23 Million for AI-Native Identity Governance (https://www.securityweek.com/opal-security-raises-23-million-for-ai-native-identity-governance/) CVEs Referenced: CVE-2026-10722, CVE-2026-11332, CVE-2026-27145, CVE-2026-3276, CVE-2026-3300, CVE-2026-37460, CVE-2026-42504, CVE-2026-42507, CVE-2026-43958, CVE-2026-50219, CVE-2026-5419, CVE-2026-7774, CVE-2026-8643, CVE-2026-8829 Indicators of Compromise: IPs: 202.56.2.126, 209.146.60.26 Full brief: https://carolinacleartech.com/brief/2026-06-07/