SKELERSECURITY

Category: Vulnerability / Cybersecurity Advisory A critical WordPress plugin vulnerability in Modular DS is being actively exploited in the wild, exposing websites to full administrator compromise. This issue was first reported by The Hacker News and verified by security researchers. The flaw, tracked as CVE‑2026‑23550 , carries a CVSS score of 10.0 , indicating maximum severity and impact. Scope and Timeline of Activity The Modular DS plugin — installed on over 40,000 WordPress sites — contains an authentication bypass flaw in all versions up to and including 2.5.1 . A patch is available in version 2.5.2 , and immediate updates are strongly advised. Active exploitation was first seen on January 13, 2026 , when attackers made HTTP GET requests to the endpoint: /api/ modular - connector /login/ These requests were followed by attempts to create unauthorized admin users on compromised sites. Known IP addresses observed during attacks include: 45.11.89[.]19 185.196.0[.]11 Technical ...

 The Australian Signals Directorate (ASD) has issued a bulletin warning of active cyber attacks against unpatched Cisco IOS XE devices in Australia that deploy a previously undocumented implant named BADCANDY  ( The Hacker News ). The agency links the campaign to exploitation of CVE-2023-20198 , a critical flaw rated CVSS 10.0 that permits a remote, unauthenticated attacker to create an account with elevated privileges and take control of affected systems ( The Hacker News .) Scope and timeline of activity ASD reports that variations of BADCANDY first appeared in October 2023 and that attacks have continued through 2024 and into 2025 ( The Hacker News ). The agency estimates roughly 400 devices in Australia were compromised since July 2025, with about 150 infections recorded in October 2025 alone ( The Hacker News ). Technical characteristics of BADCANDY Type: Lua-based web shell. Persistence: Non-persistent; the implant does not survive a reboot, but attackers com...

In an era where digital threats evolve faster than the systems designed to prevent them, one mission remains steadfast: empowering people and protecting innovation. SkelerSecurity was born from a vision not just to defend cyberspace, but to redefine how we educate, secure, and evolve within it. SkelerSecurity is more than a cybersecurity company. It’s a movement—one that merges technical precision with ethical responsibility. Whether you're an enterprise securing its assets, a student breaking into the field, or a curious mind seeking digital resilience, our goal is to make security accessible, actionable, and approachable for all. Education First : Through platforms like CyberNexus , hands-on Capture the Flag (CTF) events, and inclusive resources, we bring the thrill of cybersecurity to learners at every level. Technical Excellence : Our team of Red and Blue specialists works tirelessly to address vulnerabilities before they become news headlines. Ethical Innovation : We priori...