SQL injection

Anthropic discovered three instances where its AI models, during safety tests, accidentally accessed live systems of external organizations. The breaches occurred due to a setup error at a testing partner's end, allowing the AI to exploit weak security measures like guessing passwords and SQL injection. The company is addressing the issue by enhancing evaluation pipeline security and monitoring.

WordPress patched a critical core vulnerability chain called wp2shell, which allows attackers to gain full control of sites without authentication, leading to risks like credential theft, malware delivery, and malicious redirects for visitors. Attackers have already begun exploiting the flaw, injecting harmful content and compromising user trust.

Bob Starr created a website called 'Boomberg' to display how much US tax money is allocated to tech companies, but months after launching it, he discovered a hidden SQL injection vulnerability that could have allowed attackers to access or modify sensitive data. Starr, a project manager in the tech sector, acknowledged the oversight as a learning blind spot and warned others might make similar mistakes.

Cybersecurity researchers disclosed three patched security flaws in LangGraph, an open-source framework by LangChain for building AI agents, including a critical vulnerability chain that could lead to remote code execution.

A large-scale campaign is exploiting a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS to inject malicious JavaScript code, enabling ClickFix attack flows. The flaw allows attackers to execute arbitrary SQL commands and compromise affected websites.

CISA has added a critical SQL injection vulnerability (CVE-2026-9082) in Drupal Core to its KEV catalog due to active exploitation. The flaw affects all supported versions of Drupal Core and carries a CVSS score of 6.5.

A critical SQL injection vulnerability (CVE-2026-42208) in BerriAI's LiteLLM Python package was exploited in the wild within 36 hours of disclosure. The flaw, with a CVSS score of 9.3, allows attackers to modify underlying data through SQL injection attacks.

Hackers are exploiting a critical pre-authentication SQL injection vulnerability (CVE-2026-42208) in the LiteLLM open-source LLM gateway to access sensitive information. The flaw allows attackers to bypass authentication and manipulate database queries, risking data exposure.