Zero Spam (@ZeroSpamOrg) | teapawt

Zero Spam@ZeroSpamOrg11h

PHP2Shell: two critical PHP flaws let attackers run code on web servers without logging in, and attacks have started. Fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Who's at risk, who isn't, what to do (updated daily): zerospam.org/php2shell-php-v…

PHP2Shell (CVE-2026-109618): What to Do Now, Live

PHP2Shell lets attackers take over PHP web servers without a login, and attacks have started. Fixed versions, who is at risk, who isn't, and steps, daily.

58

Zero Spam@ZeroSpamOrg12h

Scamwise users report a never-before-seen fake store about every 3 minutes, many copying real brands and buying Google and Meta ads. 5 steps to find and report copies of your store: zerospam.org/fake-online-sto…

Fake Online Stores 2026: Find and Report Brand Clones

Scamwise users report new fake online stores about every 3 minutes, many copying real brands. 5 steps to find clones, report them and warn customers.

9

Zero Spam@ZeroSpamOrgOct 21

Fake meeting invites reached 40,000+ organizations this fall, and they can sit on your calendar even when the email gets filtered. The settings that stop it: zerospam.org/stop-calendar-i…

How to Stop Calendar Invite Phishing (2026 Guide)

Calendar invite phishing reached 40,000+ organizations, Check Point says. Change these Google Calendar and Microsoft 365 settings and train your team.

15

Zero Spam@ZeroSpamOrgOct 20

Meta's Muse AI agent is filling in website forms from cloud servers, without saying it's an AI agent. In DataDome's sample, forms got 81% of its sensitive-page traffic. 5 decisions for your forms: zerospam.org/meta-muse-ai-ag…

Meta Muse AI Agent and Your Website Forms (2026)

The Meta Muse AI agent sends form traffic from cloud servers without naming itself, DataDome found. What it means for leads and 5 decisions to make.

19

Zero Spam@ZeroSpamOrgOct 19

Microsoft disrupted Yam Store, a phishing marketplace tied to over one billion scam emails and texts. Some of its accounts reused names of organizations whose domains had expired. 5 checks for your domains: zerospam.org/yam-store-phish…

Yam Store Phishing Takedown: Expired Domain Risks

Microsoft disrupted Yam Store, a phishing marketplace tied to over a billion scam messages. How expired domains got reused and 5 checks for site owners.

1

24

Zero Spam@ZeroSpamOrgOct 19

A Ghostscript flaw (CVE-2026-39919) lets a crafted PDF corrupt memory when your server makes a thumbnail. WordPress sites that take PDF uploads should check. How to check in 3 steps: zerospam.org/ghostscript-cve…

Ghostscript CVE-2026-39919: Is Your WordPress Site Exposed?

CVE-2026-39919 lets crafted PDFs attack Ghostscript when WordPress makes thumbnails. Check Site Health, ask your host, and use these stopgaps.

57

Zero Spam@ZeroSpamOrgOct 19

Some Rank Math PRO 3.0.123 downloads from Oct 15-16 contained malware. If an affected copy was active, updating to 3.0.124 doesn't clean the site. How to check when your copy arrived: zerospam.org/rank-math-pro-3…

Rank Math PRO 3.0.123 Malware: What Site Owners Should Do

Rank Math PRO 3.0.123 downloads from Oct 15-16 contained malware. Check when you updated, look for the signs, and recover in the right order.

11

Zero Spam@ZeroSpamOrgOct 13

Some phishing emails now carry a second, hidden message for your AI assistant, like a fake vendor payment change in the summary. How it works, plus 5 defenses: zerospam.org/hidden-prompt-i…

Hidden Prompt Injection in Phishing Emails (2026)

Phishing emails now carry hidden prompt injection aimed at AI assistants. How the hidden text works and 5 ways to stop AI summaries from steering your team.

22

Zero Spam@ZeroSpamOrgOct 12

Google now calls fake author profiles a form of deception: AI headshots, made-up names, false credentials. What changed, plus 5 checks for your site: zerospam.org/google-fake-aut…

Google Warns on Fake Author Profiles: 5 Checks (2026)

Google's helpful content guide now calls fake author profiles deception and says AI drafts need human fact-checks. What changed and 5 checks for sites.

22

Zero Spam@ZeroSpamOrgOct 8

Fake ChatGPT, Gemini and Meta Muse ad tools are phishing ad-account logins. The "Connect" pop-up is drawn inside the page, and a live operator asks for your MFA code. 5 checks for marketers: zerospam.org/fake-ai-ad-tool…

Fake AI Ad Tools Phishing: 5 Checks for Ad Accounts

Fake AI ad tools posing as ChatGPT, Gemini and Meta Muse target Google, Meta and TikTok ad logins. How the scam works and 5 checks for marketers.

1

51

Zero Spam@ZeroSpamOrgOct 7

Phishing was the way in for 23% of intrusions in Microsoft's 2026 Digital Defense Report, up from 7%. What AI phishing means for site owners, plus 5 checks: zerospam.org/microsoft-digit…

Microsoft Digital Defense Report 2026: 5 Site Owner Checks

Microsoft Digital Defense Report 2026: phishing rose from 7% to 23% of intrusions as AI scales spear phishing. What it means for site owners, plus 5 checks.

24

Zero Spam@ZeroSpamOrgOct 7

WordPress 7.1.3 fixes 7 security flaws. One is a stored XSS on the Comments screen, exploitable via pending comments. Update, and don't click links in pending comments until you do: zerospam.org/wordpress-7-1-3…

WordPress 7.1.3 Security Release: Pending Comment XSS

WordPress 7.1.3 fixes 7 security flaws, including a stored XSS via pending comments and a private-post comment leak. What to check and how to update.

30

Zero Spam@ZeroSpamOrgOct 5

In Cloudflare, setting AI Training bots to Block also blocks Googlebot, and Google drops pages that return 403s. How to check your site in 15 minutes: zerospam.org/cloudflare-ai-b…

Cloudflare AI Bot Settings Can Block Googlebot: Check Now

Cloudflare AI bot settings that block Training also block Googlebot. See what changed Sep 15, 2026, how to check Search Console, and which setting to pick.

1

27

Zero Spam@ZeroSpamOrgOct 5

Google paused new reports to its open source bug bounty after a rise in automated submissions, most of them invalid. Why AI slop is a spam problem, and 5 steps for your own forms: zerospam.org/ai-slop-submiss…

AI Slop Submissions: Lessons From Google's Bounty Pause

Google paused its OSS bug bounty over invalid automated reports. Why AI slop submissions are spam, and 5 steps to protect your forms, comments and inbox.

27

Zero Spam@ZeroSpamOrgOct 1

Bots pretending to be known AI crawlers got past more than 7 in 10 sites in DataDome's 2026 test. A user agent is just text. What the report means for your login and signup pages: zerospam.org/bad-bot-traffic…

Bad Bot Traffic Up 124% in 2026: What Site Owners Should Do

DataDome's 2026 report: bad bot traffic up 124%, AI bots hitting login pages, fake signups up 34.5%. What it means for your site and five checks to run.

26

Zero Spam@ZeroSpamOrgSep 30

Google's September 2026 spam update is still rolling out, and its spam policies cover comment spam, fake profiles and hacked pages on your site too. 6 checks to run this week: zerospam.org/google-septembe…

September 2026 Spam Update: 6 Checks for Site Owners

Google's September 2026 spam update started Sep 24. Six checks for user-generated spam, hacked pages and manual actions, plus what recovery looks like.

65

Zero Spam@ZeroSpamOrgSep 29

OpenAI's test agents tried to build a CAPTCHA solver to create accounts, and turned a dormant wiki into a message board. 5 lessons for your forms and forgotten sites: zerospam.org/openai-rogue-ag…

OpenAI Agent Spam and CAPTCHAs: What Site Owners Should Do

OpenAI's rogue agents built a CAPTCHA solver and spammed a dormant wiki. What happened, plus 5 lessons for protecting forms, sign-ups and old sites.

26

Zero Spam@ZeroSpamOrgSep 28

Gravity Forms 3.1.0.4 and older accept uploads from anyone through a File Upload field set to Hidden (CVE-2026-84434, CVSS 9.8). Exploit code is public. Update to 3.1.1+, then run these checks: zerospam.org/gravity-forms-c…

Gravity Forms CVE-2026-84434: Fix and Checks | Zero Spam

CVE-2026-84434 lets unauthenticated attackers upload files via hidden Gravity Forms upload fields. Update to 3.1.1+, then run these WP-CLI checks.

1

24

Zero Spam@ZeroSpamOrgSep 27

Visual Composer 45.16.0 and older let unauthenticated attackers run files on your server (CVE-2026-12227). The fix shipped in July without a security note. Update to 45.16.3, then run these checks: zerospam.org/visual-composer…

Visual Composer CVE-2026-12227: Fix and Checks | Zero Spam

CVE-2026-12227 lets unauthenticated attackers run files via Visual Composer 45.16.0 and older. Update to 45.16.3, then run these WP-CLI and log checks.

1

14

Zero Spam@ZeroSpamOrgSep 26

In Elementor 4.3.0 and 4.3.1, one link clicked by a logged-in admin can create a new admin (CVE-2026-62062). Update to 4.3.2, then check for admins added since September 22: zerospam.org/elementor-cve-2…

Elementor CVE-2026-62062 CSRF: Fix and Checks | Zero Spam

CVE-2026-62062 in Elementor 4.3.0 and 4.3.1 lets one link create an admin. Update to 4.3.2, then check new admins and logs with these WP-CLI commands.

13