Author: NCIJ NETWNCIJ NETWORK

The exploitation of a fresh WordPress vulnerability started within hours of public disclosure and has escalated to active compromises, security firm Patchstack warns. Tracked as CVE-2026-87902 (CVSS score of 9.2), it is a path traversal flaw in WordPress’ page-template resolution. Under certain conditions, unauthenticated attackers could exploit it for remote code execution. “An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file outside the active theme directories. If relevant pre-conditions for both the server environment and the active theme are met, this can lead to RCE,” WordPress’ advisory reads. The security defect can be triggered…

The Trump administration is reportedly considering an initiative to promote the use of dollar-backed stablecoins overseas as part of an effort to reinforce the US dollar’s position as the world’s reserve currency. Citing people familiar with the plans, Bloomberg reported on Wednesday that the US government could support stablecoin projects by creating joint ventures with private-sector firms. The effort could involve several federal agencies, including the Treasury Department, State Department and the US International Development Finance Corporation (DFC).The initiative would seek to expand the international use of dollar-denominated stablecoins while potentially boosting demand for US Treasurys, a common reserve asset for…

NASA announced Wednesday a mission to explore the history and evolution of the universe, PRIMA (PRobe far-Infrared Mission for Astrophysics), is advancing to the next phase of development. This space telescope is the first in a new class of NASA astrophysics missions, called Probe Explorers, within the agency’s longstanding Explorers Program. “The PRIMA mission is humanity’s next window into the deep universe. It will unveil the obscure across cosmic time to better understand the formation of planets, stars, black holes, and even how water on Earth came to be,” said Nicky Fox, associate administrator, Science Mission Directorate, NASA Headquarters in…

Botanists in Thailand have identified a new-to-science species of “fairy lantern” — plants that live almost entirely buried under leaf litter, emerging aboveground only occasionally to flower. Researchers were surveying evergreen forests in the mountains of Thong Pha Phum National Park when they chanced upon a plant none of them had ever seen before, at an elevation of almost 1,000 meters (about 3,300 feet). They’ve since named it Thismia daemona, according to a recent study. Like other plants within the Thismia genus, commonly referred to as fairy lanterns, T. daemona lacks chlorophyll, meaning it can’t photosynthesize. Instead, it…

“Disaster.” German Chancellor Friedrich Merz was not mincing words Sunday night when he described the results of the state elections for his center-right Christian Democratic Union (CDU) party. The CDU fell below the 5 percent threshold in the east German state of Mecklenburg-Vorpommern—the first time in postwar German history that the CDU has failed to win representation in a state election. The far-right Alternative for Germany party (AfD) finished first in Mecklenburg-Vorpommern with 38 percent, the second time that it has notched a first-place finish in September after garnering nearly 44 percent of the vote in the east German state…

Emma, the NRL and Tones and I seem to be at war – but I can’t make sense of what’s going on.I’ll try to catch you up. The Dance Monkey singer made headlines this week after it was leaked she’d turned down an offer to perform at next weekend’s NRL grand final. The rugby league boss Peter V’landys said negotiations broke down due to “artistic differences”, and some claimed it was because the Aria award-winning artist didn’t want to play her biggest hit.Instead, the grand final will go ahead without pre-game entertainment, and V’landys has put $1m towards junior rugby…

Lidl must stop selling copycat versions of Birkenstock’s famous sandals in the Netherlands, a Dutch court has ruled.The discount supermarket chain faces a fine of €5,000 (£4,200) per day if it fails to comply and must also hand over sales data to Birkenstock, according to the ruling. Lidl must also compensate Birkenstock and pay its legal fees, with the amount to be decided in separate court decisions.Birkenstock said the judgement sent a clear message that “copycats must not be allowed to free-ride on [our] creativity and innovation”. The BBC has contacted Lidl for comment. The ruling, which can still be…

In May 2025, when Keir Starmer was still prime minister, Labour politicians, campaigners and journalists gathered at the Ministry of Sound in London to watch a series of panel talks and presentations illuminated by the lucid glow of club lights. The day-long event was organised by a campaign group called Compass, and the subjects included child poverty, the Murdoch-owned media and the rise of the radical right.“We felt as though the Labour government was failing, and needed to be pulled into the 21st century,” Neal Lawson, the founder of Compass, told me. The Starmer government’s support for the Conservatives’ two-child…

FoodNeverComes belongs to a new internet genre: “dopamine sites”, which recreate the rituals of consumption without the consumption. There are fake shopping sites, fake delivery services and even fake holidays.The genre took off in South Korea, external and has since travelled well beyond, spawning a growing crop of sites – Dopamine Shop, external or Fakehaul, external, for example – that mimic everything from food delivery and shopping to travel. What, exactly, are we enjoying when we enjoy buying something?The idea began with the founders’ own shopping habits. Parmar and Sharma met on a computer science diploma course and later started…

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. Initial attack traffic was only for reconnaissance and started less than five hours after the patch was released in WordPress 7.1.2. Malicious activity increased by ten times, and attackers are now trying to deliver payloads. WordPress security firm Patchstack reports that it observed the first malicious requests at 17:44 UTC on September 22 from a small group of IP addresses targeting multiple sites under its protection. Discovered by security researcher Robert Ressl, the issue…