Every 24 hours
Tech News
Original reporting on what changed in security, rewritten in full and dated with the day the story broke. Each edition adds at least four articles and skips a topic already covered.
Oct 14, 2026
Critical Access Control Vulnerability Found in WordPress Push Notification Plugin
A significant security flaw has been identified in the WordPress Push Notification for Post and BuddyPress plugin, specifically in versions up to and including 3.23. This vulnerability, attributed to inadequate access control measures, allows unauthorized users to exploit misconfigured security levels, potentially leading to unauthorized access to sensitive information. The issue stems from a missing authorization check, which could enable attackers to manipulate notifications or access data that should be restricted.
The vulnerability affects all installations of the plugin that are running version 3.23 or earlier. Given the widespread use of WordPress for website management, this flaw could impact a large number of sites utilizing this plugin for push notifications. As a result, website administrators are urged to assess their current plugin versions and take necessary action to secure their platforms.
The consequences of this vulnerability could be severe, as it may allow attackers to gain access to user data or modify notification settings without proper authorization. This not only poses a risk to the integrity of the affected websites but also undermines user trust. In an era where data privacy and security are paramount, such vulnerabilities can have far-reaching implications for both site owners and their users.
To mitigate the risks associated with this vulnerability, it is crucial for administrators to promptly update the plugin to the latest version or implement additional security measures to prevent unauthorized access. Continuous monitoring and regular updates are essential practices in maintaining the security of WordPress installations, especially when third-party plugins are involved.
Oct 14, 2026
Vulnerability in Anthropic's Claude Code Exposes Developer Secrets
A significant vulnerability has been discovered in Anthropic's Claude Code Desktop application, potentially compromising developers' sensitive information. Researchers from Noma Security identified a flaw, dubbed 'SneakPeek', which affects the app's automated preview pane that renders HTML files.
This vulnerability allows malicious JavaScript embedded within an HTML file to execute without any user interaction, posing a serious risk of exposing sensitive files on a developer's machine. The implications of this flaw are particularly troubling, as it could lead to the unauthorized access and exfiltration of critical data, such as AWS credentials, GitHub secrets, and SSH private keys.
Attackers could exploit this weakness by placing a malicious file in a public repository and enticing developers to request an inspection via Claude Code. Once the application processes the file, the embedded script could gain access to local files and send sensitive information to a remote server.
This incident underscores the evolving threat landscape, particularly as attackers increasingly target AI ecosystems and exploit the inherent trust between various components and services. 7, highlighting the urgent need for developers to be cautious when interacting with AI tools that process external files.