Picus Security

An unauthenticated RCE sat in WordPress core for 18 years, and it's now on CISA's KEV list.

Our researcher, Umut Bayram, found CVE-2026-119977 in about four hours with an AI model. Here he explains how it works and what to do before you update.

Write-up below.

Our team joined the STACK Conference 2026 with Singapore’s public and private sector tech community. Thank you to everyone we met. Until the next one. #GovTech #Cybersecurity

Frontier models have found thousands of zero days, three years after people said AI never would.

@mikko told The Validation Summit ’26 that the world changes faster than we can react, and “the only way to fight AI enabled attacks is with AI enabled defense.”

#AISecurity

A scheduled task called GoogleErrorReport runs a legitimate Windows program every minute. That is how Dropping Elephant keeps its RAT coming back. Read more: hubs.li/Q04CYRRP0

#ThreatIntelligence #SecurityValidation

NERC CIP asks for evidence. Security validation produces it every time you test. Our guide maps it requirement by requirement. Read more: hubs.li/Q04CYRDB0

#NERCCIP