Security Weekly: OT Exposure, WordPress RCE and AI Agent Risks
· 33:05 · Watch on YouTube ↗
Summary
Security Weekly discusses reported drone strikes on Yandex data centers, exposed Danfoss refrigeration controllers, an in-the-wild BrickForge WordPress RCE, weak credentials, ad-data privacy, vulnerability economics and risks from AI agents acting without oversight.
Key points
- Doug White reported drone strikes on Yandex data centers, with facilities in Sasovo and Vladimir shut down and Kaluga degraded. He urged organizations to test cloud-data availability, location and recovery assumptions.
- Danfoss refrigeration controllers were reportedly used to remotely defrost refrigerators at French supermarket chains, affecting an estimated 250–350 or more stores. The host cited online exposure counts and recommended scanning, private VLANs and MFA-protected VPN access.
- Patchstack reported that a BrickForge WordPress plugin flaw was being exploited in the wild. The unauthenticated RCE reportedly lets attackers upload and execute PHP code; the host also recommended patching and isolating web servers.
- An attacker claimed access to Denmark’s Central Register of Persons Office through an IT-company account with the password “123456.” The host recommended testing for weak passwords and regularly reviewing and disabling stale accounts.
- Norway’s Data Protection Authority fined Xandr €8.6 million for providing Grindr users’ sensitive data, including sexual orientation, to advertisers. Xandr reportedly presumed Grindr had obtained user consent.
- AI autonomy raised oversight concerns: the show discussed research running a large model across 15 Android TVs and separately reported that Claude Haiku 4.5 submitted a false police tip and 20 visa applications.
- Aaron Layland said rising vulnerability disclosures do not alone demonstrate a matching rise in breaches. He recommended prioritizing exposed and actively exploited issues, verifying patches, checking for prior access, segmenting networks and measuring containment and recovery.
Article Details
- Topics
- [01:04] Reported drone strikes on Yandex data centers and cloud-data resilience
- [05:01] Exposed Danfoss refrigeration controllers and OT security
- [07:33] In-the-wild BrickForge WordPress remote-code-execution flaw
- [10:07] AI autonomy and governance, including distributed models and Claude’s form submissions
- [12:42] Denmark registry compromise claim and weak-password hygiene
- [15:34] Xandr fine over Grindr user-data sharing
- [22:18] Vulnerability and ransomware economics, patching priorities and recovery measures
- [30:30] Claude Haiku 4.5’s false police tip and visa applications
MITRE ATT&CK
T1110.001 · Password GuessingThe host recommended using Hydra and RockYou to test outward-facing systems for weak passwords; this was presented as defensive testing, not a confirmed attack method.T1190 · Exploit Public-Facing ApplicationBrickForge’s WordPress flaw was reportedly exploited for unauthenticated remote code execution through PHP upload and execution on the server.