🚨 WordPress Logins Bypassed, and Russia Bugged Slovakia's Speed Cameras

Two stories from today's security news show how differently attacks can arrive: one through a plugin you already installed, and one through hardware a government bought and bolted to the side of a road. Both are worth five minutes of your attention.

Attackers Are Walking Straight Into WordPress Admin Panels

Hackers are actively exploiting two critical flaws (CVE-2026-61979 and CVE-2026-15981) in the popular miniOrange SAML 2.0 SSO plugin for WordPress. By manipulating how the plugin checks cryptographic signatures, attackers can forge a legitimate-looking login response and hand themselves full administrator access — no password required.

If your business runs a WordPress site with single sign-on, this matters. An attacker with admin rights can plant malware for your visitors, steal customer data, or quietly keep a foothold for months. The nasty twist: if you use the premium edition, WordPress will not show you an update warning. You have to check your plugin version manually and upgrade to the patched release yourself — today, not next sprint.

Read more →

Slovakia's New Speed Cameras Came With a Russian Backdoor

Slovakia's national security service found that recently installed traffic speed cameras contained a hidden backdoor — one that could be triggered by text message from hardcoded Russian phone numbers, giving remote command-line and network access to the devices. The cameras, sold as NERO R-ONE units and allegedly purchased through a Cyprus shell company, turned out to be rebadged hardware built by a firm in St. Petersburg. Investigators also found the devices shipped with secure boot switched off and their live video streams viewable by anyone, no login needed.

The lesson isn't really about cameras. It's that the equipment you buy can be compromised before it ever reaches your door, and a reseller's label tells you nothing about who actually built the thing or what they left inside it. Knowing your vendors — and your vendors' vendors — is now a core security control, not paperwork.

Read more →

Stay ahead of threats with GOCO Security at gocosecurity.com.