Today’s stories span the full lifecycle of a security incident — a maximum-severity bug that needs patching before it’s exploited, an active extortion attempt in progress, and an arrest that closes out a campaign from earlier this year. Here’s what’s new since yesterday’s digest.
Vulnerability watch: CVSS 10.0 unauthenticated RCE in GiveWP hits 100,000+ WordPress donation sites
Researcher Udin Chan, working through the Patchstack bug bounty program, disclosed CVE-2026-82222 in the GiveWP donation plugin — a maximum-severity flaw that lets an unauthenticated attacker execute arbitrary commands on the hosting server. The bug chains three separate issues: an unsafe PHP deserialization helper, a donation-processing flow that stores attacker-controlled serialized objects, and a gadget chain in a bundled library that turns deserialization into command execution. Compounding the exposure, GiveWP ships an unauthenticated registration action that ignores WordPress’s own “disable public registration” setting, so even sites that think they’ve locked down account creation are reachable. GiveWP shipped a fix in version 4.16.7.2, blocking serialized data during donation processing and restricting object instantiation. No exploitation in the wild has been reported yet, but with 100,000+ active installs and a CVSS 10.0 rating, that’s likely a matter of when, not if. BleepingComputer · SecurityWeek
If any donation, e-commerce, or membership plugin on your WordPress footprint touches user-submitted data during checkout, this is the reminder to check your patch cadence on plugins, not just WordPress core. A CVSS 10.0 bug with no authentication requirement on a public-facing payment flow doesn’t leave much of a window for “we’ll get to it next sprint.”
Ransomware watch: Rhysida claims 5.79TB from Berlin’s state government, demands 30 BTC, gets refused
Berlin’s state government confirmed it’s the target of an active extortion attempt following a network compromise first detected on August 7 in the Senate Department for Mobility, Transport, Climate Protection and Environment; the affected systems were cut off from the network on August 14. On August 28, the Rhysida ransomware group posted a claim on its leak site asserting it exfiltrated 5.79TB of data — roughly 1.44 million files, including about 80,000 administrative fine proceedings, 46,500 contracts, nearly 6,000 files containing login credentials, and personal data tied to over 12,000 individuals. Rhysida is demanding 30 bitcoin (roughly $2.3 million) with a one-week deadline before threatening to publish the data. Berlin’s mayor and interior senator issued a joint statement: “The state of Berlin will not submit to extortion.” The timing is notable — the attack lands less than a month before the city-state’s September 20 elections. The Hacker News · DataBreaches.net
Nearly six thousand files with login credentials sitting in a government file share is the detail worth flagging internally: credential sprawl inside internal document stores is a routine finding, not an edge case, and it’s exactly what turns a single-department breach into an organization-wide password-reset exercise. If you haven’t run a search for plaintext credentials in your own shared drives recently, it’s a cheap check with a real payoff.
Law enforcement watch: Two Australian men charged over the TeamPCP supply-chain campaign
The Australian Federal Police and Western Australia Police Force, working with the FBI, arrested and charged two Perth men — a 21-year-old alleged to be the ringleader and a 23-year-old alleged co-participant — over their roles in TeamPCP, the group behind a wave of software supply-chain attacks that hit open-source ecosystems throughout 2026. Investigators estimate the campaign compromised more than 1,000 organizations worldwide, harvested over 500,000 credentials, and exfiltrated at least 300GB of data, with remediation costs potentially reaching hundreds of millions of dollars. Charges include large-scale cyber crime, identity theft, data intrusion, and money laundering. SecurityWeek · Cybernews
Arrests rarely undo the damage already done, but the credential-harvesting scale here is the operational takeaway: if your org pulled packages from any open-source registry during the campaign’s active window this year, rotating credentials that touched CI/CD pipelines is worth confirming rather than assuming someone already did it.
Also noted
The White House signed Executive Order 14420 on August 26, declaring a national emergency over foreign-made bulk-power system equipment and banning the purchase, import, or installation of grid technology — inverters, transformers, protective relays, generators, and their control software — sourced from a list of 24 flagged countries when it poses a backdoor or remote-access risk. Energy officials have 120 days to inventory current equipment and build an approved-vendor list. SecurityWeek
PaperCut’s patched-but-still-exposed problem from earlier this week has escalated: Huntress reports active probing and at least two confirmed exploitation attempts, and finds that 47% of the roughly 2,500 installations it tracks are still running version 23 or older — for which no patch currently exists. If you’re on an older PaperCut branch, isolating the server from the internet is the interim mitigation until a fix ships. Security Affairs
Final thought
Three different failure points show up today: a plugin trusting deserialized data it shouldn’t, a government department that didn’t notice exfiltration for a week, and a supply-chain campaign that ran long enough to compromise a thousand organizations before anyone was arrested. None of these are novel attack techniques — they’re the same gaps that show up in nearly every digest, just wearing different names. If you want a second set of eyes on whether your own logging would catch something similar moving through your environment, see our how-to guides or book a discovery call.