A busy week for hackers targeting business software
Security teams are dealing with three separate attack campaigns this week, all going after software that businesses and website owners rely on every day. Microsoft SharePoint, an AI development tool called Langflow, and WordPress have all been hit with active exploitation of critical vulnerabilities. While these tools sit mostly behind the scenes for everyday internet users, the fallout from these attacks can reach anyone whose personal information is stored on the affected systems.
SharePoint attackers are stealing the keys to the building
The most concerning of the three involves Microsoft SharePoint Server, software that many companies use to store and share internal documents. Researchers found that attackers are exploiting a flaw tracked as CVE-2026-50522 to break into SharePoint servers and steal something called machine keys.
Machine keys are a bit like a master key for a building. Once someone has a copy, they can keep coming back in even after the original lock is changed. In this case, that means even after a company installs Microsoft's security patch, attackers who already stole the keys may still be able to access the system and pretend to be legitimate users. This gives them a way to quietly hang around inside a network long after the initial break-in.
The flaw itself is rated as one of the most severe kinds a vulnerability can be, since it lets an attacker run their own code on a server without needing a password or any special access first. Microsoft has already released a patch, but simply installing it may not be enough for organizations whose keys were stolen before they updated.
Government agencies told to fix an AI tool immediately
The second issue involves Langflow, a tool developers use to build AI-powered applications and chatbots. The Cybersecurity and Infrastructure Security Agency, the main U.S. government body responsible for tracking digital threats, ordered federal agencies this week to patch a Langflow vulnerability that is already being exploited in real attacks.
When a government agency issues this kind of urgent directive, it usually means attackers have moved from theory to practice and are actively breaking into systems using the flaw right now. Langflow is popular among developers building AI tools, so any organization using it, not just government agencies, should treat this as a signal to check for updates immediately.
WordPress sites are being turned into hidden backdoors
The third campaign targets WordPress, the software that powers a huge share of websites on the internet, from small blogs to large business sites. Attackers are exploiting a pair of flaws, nicknamed wp2shell, that affect the core WordPress software itself rather than a specific plugin or theme.
Once attackers get in through these flaws, they are installing what security professionals call webshells. A webshell is a small hidden program that gives an attacker ongoing remote control over a website, letting them come back later even if the original vulnerability gets patched. In some cases, attackers are also installing fake plugins designed to look normal while secretly giving them continued access.
For website owners, this kind of attack is especially dangerous because it can go unnoticed for a long time. A hacked site might keep working normally for visitors while quietly being used to steal customer data, send spam, or serve as a launching pad for attacks on other websites.
Why this matters even if you don't run a website
None of these three programs are things most people install on their personal phone or laptop. But all three sit behind services that regular people use every day, whether that is a company intranet built on SharePoint, a customer service chatbot built with Langflow, or a small business website running WordPress. When these systems get compromised, the information they hold, including names, emails, passwords, and payment details, can end up exposed or stolen.
What you should do
- If you manage a SharePoint server: install Microsoft's latest patch immediately and consider rotating machine keys, since patching alone may not remove an attacker who already stole them.
- If your organization uses Langflow: update to the latest version right away and review recent activity logs for signs of unauthorized access.
- If you run a WordPress site: update WordPress core to the latest version, remove any plugins you don't recognize installing, and scan for hidden files or unfamiliar admin accounts.
- If you're a regular user of any affected service: watch for unusual account activity, use unique passwords for every site, and turn on two factor authentication wherever it's offered so a stolen password alone isn't enough to get into your account.
