Critical Bricksforge WordPress flaw under active attack
A severe security flaw in the Bricksforge WordPress plugin is being actively exploited, according to Patchstack. The vulnerability, rated 10.0 on the CVSS scale and tracked as CVE-2026-85097, lets unauthenticated attackers upload and run arbitrary PHP code, granting full remote code execution on affected sites. Versions up to 3.1.8.9 are vulnerable; a patch was released in 3.1.8.10. Exploitation attempts began on October 7, 2026.
- Flaw allows unauthenticated remote code execution
- Impacts Bricksforge versions up to 3.1.8.9
- Patch available in version 3.1.8.10
- Attackers exploiting bug since October 7, 2026
Sources covering this
More in Cybersecurity
Cyberattack disrupts refrigeration at French supermarkets
A cyberattack hit refrigeration systems at hundreds of French supermarkets, including Intermarché, Leclerc, and Coopérative U, after…
UK to tighten cyber defences as AI risks escalate
The UK's AI minister called for tougher safety standards from leading AI firms as the government plans to enhance national cyber…
Google fixed major DevSite RCE flaw after two months
Google took two months to fix a critical vulnerability in its developer documentation platform, DevSite, after a researcher discovered…
Researchers find Windows malware using Tox for control
Security researchers have identified AvisLoader, a new Windows malware loader that uses the encrypted Tox peer-to-peer messaging network…