As cited
Copy frozen at (site build).
breaches incidents
Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation
GreyNoise tracked a malicious IP address from early June 2026 onward that conducted widespread scanning and attacks against multiple technologies. The actor exploited WordPress to breach a western government entity and exfiltrate more than 18,000 sensitive records.
Why it matters: Government agencies running WordPress need immediate assessment of their instances for compromise indicators and access logs, as this attack demonstrates active exploitation of the platform for high-value record theft.
- Source published
- First seen by Cybersecurity Tracker