Today’s Field Note

Two things worth your attention today, both boring in the way that gets people breached. Microsoft disclosed TerminalFix, a ClickFix spin that steers victims into Windows Terminal or PowerShell instead of the Run dialog, which lets attackers run longer, uglier commands to drop a reverse-tunnel backdoor. Separately, Wordfence and Patchstack flagged five critical bugs across WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, led by CVE-2026-76581 (CVSS 9.8), an auth bypass. WordPress mass-exploitation of critical plugin flaws is not a maybe, it is a calendar event, usually within days of disclosure. Neither of these needs a nation-state to hurt you, just a distracted user or an unpatched site.

Today’s Action

  • Patch the five WordPress components now: WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. Prioritize CVE-2026-76581 (auth bypass, CVSS 9.8).
  • Audit affected WordPress sites for new admin accounts, unexpected plugins, and modified theme files in case exploitation preceded your patch.
  • Hunt for TerminalFix: alert on Windows Terminal (wt.exe) and powershell.exe spawned from browser processes or with clipboard-pasted command lines.
  • Block or restrict outbound reverse-tunnel tooling and unexpected long-lived outbound connections from user endpoints.
  • Reinforce the “never paste a command someone told you to run” message to users, and consider disabling the Run dialog and Terminal for non-technical roles.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

It’s not paranoia if the CVE already has a CVSS score.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.