Hackers are already using two critical flaws recently patched in WordPress to invade unupdated websites. Cybersecurity firms have confirmed that these attacks are currently taking place.
The warning about the vulnerabilities emerged just days after WordPress released the patches and recommended that administrators update their sites immediately. To speed up the application of fixes, the platform also activated automatic updates on compatible installations.
Cybersecurity researchers, including Patchstack, Hexastrike, and WatchTowr, detected that criminals are already exploiting these flaws against sites running compromised versions.
The vulnerabilities specifically affect WordPress versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. Although official statistics indicate that over 400 million sites used these versions, this number may include already updated installations.
Daniel Card, a cybersecurity consultant, analyzed a sample of about 4,200 sites and concluded that less than 15% were still vulnerable. If this estimate is representative of the total universe of installations, about 90 million sites would remain susceptible to attacks.
The researcher pointed out several elements that contributed to the decrease in this number of vulnerabilities. These include automatic updates provided by WordPress itself, attack blocks implemented by Cloudflare, the use of firewalls and other protection tools, in addition to the fixes already made by site administrators.
One of the flaws was identified by Adam Kues of Searchlight Cyber and was named 'WP2Shell'. According to Kues, by combining this vulnerability with the second flaw corrected by WordPress, attackers gain complete remote control over the affected sites.
While attacks persist, websites still running vulnerable versions of WordPress remain open to these breaches. The platform's official recommendation is to install the latest updates to resolve the issues.
X will implement a new alert system, directly notifying all users who interacted with a post that received a correction through a Community Note via private message (DM). This change was announced by Elon Musk, the owner of the social network, in a post made on the platform itself, without a specific date for the update's release being disclosed.
Currently, when a user likes, shares, or replies to content that has a Community Note, they already receive a warning both in the application and on the X web version. However, these notifications are only triggered after the note is deemed useful and remains visible for a minimum period of 24 hours. The creators of the corrected posts are also alerted, but only after the note has been active for at least six hours.
The modification proposed by Musk consists of transforming this warning into a direct message, using X Chat, instead of a standard notification. The justification for this change lies in the fact that direct messages are considered harder to ignore than conventional notifications, which should increase the likelihood that users become aware of potentially false content.
X incorporated Community Notes as its main method of combating disinformation in 2022, two years after the feature was introduced under the name Birdwatch. This model operates based on collaborative corrections made by users themselves, without relying on centralized moderation.
A study published in the journal Nature Communications in May 2026 evaluated 237,180 'cascades'—the term used to describe posts with Community Notes and their respective shares. The research indicated that, although Community Notes are quite effective in reducing the reach of content after annotation, they often appear too late to prevent the initial and most viral dissemination of the information.
The collaborative notes model is not limited to X. In 2025, Meta suspended its third-party fact-checking system in the United States and began testing Community Notes on Facebook, Instagram, and Threads. Furthermore, X itself adjusted its methodology, allowing Community Note collaborators to request that an artificial intelligence (AI) draft the initial note, instead of writing it manually.
