AI and Tech Summaries - AI Weekly Malaysia

Summaries

Short AI and tech summaries with source links, signal scores, and why each update matters for builders, founders, and Malaysian tech workers.

Window

Today Yesterday This week Last week This month Last month All time

Showing 1-1 of 1 results

Date	Provider	Score	Summary
25 Aug 2026, 4:34 PM	The Hacker News	7.5	Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access Two unauthenticated authentication bypass vulnerabilities (CVE-2026-15981 CVSS 9.8 and CVE-2026-61979 CVSS 8.1) in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin allow attackers to log in as any user, including admins. The root cause is a loose boolean check on PHP's openssl_verify(), which returns -1 on error but was treated as truthy (valid). Both are fixed in plugin versions 17.0.5 and 17.0.6 respectively, and active opportunistic scanning from six IP addresses is already underway. Why: If you run WordPress with the miniOrange SAML plugin below version 17.0.6, patch immediately—attackers are actively scanning for this and can get full admin access without credentials. Beyond patching, the openssl_verify() tri-state return value (-1, 0, 1) being loosely compared as boolean is a PHP gotcha worth auditing in any SAML or crypto verification code you maintain. security wordpress saml php vulnerability authentication

Date

Provider

Score

Summary

25 Aug 2026, 4:34 PM

The Hacker News

7.5

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Two unauthenticated authentication bypass vulnerabilities (CVE-2026-15981 CVSS 9.8 and CVE-2026-61979 CVSS 8.1) in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin allow attackers to log in as any user, including admins. The root cause is a loose boolean check on PHP's openssl_verify(), which returns -1 on error but was treated as truthy (valid). Both are fixed in plugin versions 17.0.5 and 17.0.6 respectively, and active opportunistic scanning from six IP addresses is already underway.

Why: If you run WordPress with the miniOrange SAML plugin below version 17.0.6, patch immediately—attackers are actively scanning for this and can get full admin access without credentials. Beyond patching, the openssl_verify() tri-state return value (-1, 0, 1) being loosely compared as boolean is a PHP gotcha worth auditing in any SAML or crypto verification code you maintain.