❌

Normal view

Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs

Threat actors have been observed exploiting a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway to drop web shells and attempt theft of configuration data. LevelBlue's Threat Hunt Operations & Research (THOR) team, which analyzed the exploitation activity across multiple customer environments, said it identified malicious NetScaler

Shared host suspended our site for "excessive bandwidth" with ~50 visitors/month. Screaming Frog, UpdraftPlus, or bots?

30 September 2026 at 06:50

Hey everyone, bit of a panic post. I'm not a web person, I do marketing, but I recently ended up in charge of our company's WordPress site after the agency that built it left.

This morning the whole site was down with "this user has been suspended". Our host (Network Solutions) says it was excessive bandwidth, but support can't tell me where it came from and says to wait 24–48 hours for their specialists.

The weird part is we only get around 50 visitors a month.

Stuff I did in the last few days, in case it's my fault:

The site was still getting visits late that night, then went down overnight.

Could any of that have caused it, or is it more likely bots hitting the site? And what's the easiest way to stop this happening again? I've seen Wordfence and Cloudflare mentioned, but I'm scared of breaking our company email if I mess with DNS.

Any advice appreciated, I'm learning as I go 🙏Shared host suspended our site for "excessive bandwidth" with ~50 visitors/month. Screaming Frog, UpdraftPlus, or bots?Shared host suspended our site for "excessive bandwidth" with ~50 visitors/month. Screaming Frog, UpdraftPlus, or bots?

submitted by /u/theingikyaw
[link] [comments]

best platform/theme for a multi-user database community

30 September 2026 at 19:48

i'm building a site that will involve multiple users being able to login, upload information, and communicate with each other. in a more specific way, i want people to be able to create a product, add information about the product and a picture, and review other products. additionally i would like a community message board area. think ravelry or threadloop dot app.

i have been doing a ton of research and i think i have a general idea of which base theme to start with, but i was wondering if anyone could let me know which platforms you think are good for this type of thing.

i don't want to use buddypress because even trying to download their base platform is a nightmare of broken links, and errors on install (even the github release won't install correctly). i don't want to start out with an inferior product. so not including buddypress, what would be a good foundation theme for this type of project?

thank you in advance.

submitted by /u/hjartatjuv
[link] [comments]

Google Unveils Gemini 4 Argon, Retaking Benchmark Lead Over OpenAI and Anthropic

By: BeauHD
30 September 2026 at 18:00
Google has unveiled Gemini 4 Argon, a new frontier AI model that it says leads or ties rivals on 13 of 18 disclosed benchmarks. The model is initially being released only to trusted cyber defenders and select pre-release testers, with broader availability planned later. VentureBeat reports: Google is not claiming that Gemini 4 Argon wins every benchmark. But across the benchmark table disclosed in the company's embargoed materials, Argon posts the highest score, or ties for the highest score, in more categories than GPT-6 Astra or Claude Opus 5.5. Across the 18 benchmarks Google disclosed, Argon leads outright on 12 and ties for first on one. GPT-6 Astra leads outright on three and ties Argon on one. Claude Opus 5.5 leads outright on two. That makes Argon the leading frontier model by total number of benchmark leads or top scores in Google's comparison set, even though the results show a still-close race in which OpenAI and Anthropic retain advantages in several important technical categories. [...] The result is a more nuanced claim than "best model across the board." Argon appears to have the broadest top-score profile among the three frontier models in Google's disclosed comparison, but GPT-6 Astra remains ahead in several software, science-terminal and computer-use tasks, while Claude Opus 5.5 remains ahead in terminal-agent and post-training workflows. For enterprise buyers, that means model choice is still workload-dependent, even if Argon now gives Google its strongest claim yet to overall frontier leadership by benchmark count. [...] Argon also expands Google's output ceiling. The company says the model supports an industry-leading 1 million output tokens, up from a previous 64,000-token limit. That is a notable distinction for agentic software engineering, audit, migration and legal-review workloads where the value of a model often depends on how long it can sustain a chain of work before handing control back to a human.

Read more of this story at Slashdot.

'Xbox Is Not For Sale,' Says Microsoft's Gaming Chief

By: BeauHD
30 September 2026 at 17:00
Xbox CEO Asha Sharma says Microsoft has no plans to sell the gaming business, telling The New York Times that "Xbox is not for sale" and that the company intends to take a long-term view. Windows Central reports: Microsoft's vast layoffs across the summer have hit Xbox in their thousands, with studios like Ninja Theory on the path to being closed, and others like Double Fine being divested completely. Microsoft has effectively shut down Halo Studios itself and handed off the franchise to Call of Duty showrunners instead, as Xbox aggressively seeks to restructure for its next decade. [...] The NYT interviewed (paywall) Sharma recently covering the Xbox layoffs generally. The outlet said that Asha "did not stall" in declaring Xbox not-for-sale. "Xbox is not for sale. [...] We will do whatever it takes to set the company up for success, and we will look at the right partnerships, the right operating model and everything needed to achieve that. [...] We've got a long way to go with Microsoft and we're going to take the long-term view." The NYT quite patronizingly called the comment a "bob and weave" seemingly unwilling to let go of the idea of divestiture. It's great shareholder bait; Xbox has long been an aspirational type of product, and it has been a loss leader in some regards. Microsoft CEO Satya Nadella has remarked in the past about how, despite the fact Xbox isn't a huge profit generator, fandom of the brand has led to lucrative deals for Azure on the business side of things. Yet, shareholders would love nothing more than for Microsoft to quit the difficult and risky game industry to dive all-in on AI psychosis products instead...

Read more of this story at Slashdot.

Hackers Stole Millions of US Military Personnel Records During Months-Long Data Breach

By: BeauHD
30 September 2026 at 16:00
A months-long breach of the Defense Manpower Data Center exposed personal information belonging to roughly 2.8 million living current and former U.S. military personnel and staff, plus records for nearly 300,000 deceased people. Attackers reportedly exploited a file-sharing vulnerability between October 2025 and July 2026, accessing unencrypted records that included Social Security numbers, dates of birth, demographic information, and military service details. TechCrunch reports: The DMDC may not be widely known to the general public, but serves as one of the Department of Defense's records-keeping units. The DMDC maintains over 60 million records for U.S. military and civilian staff and their family members to help determine benefits and entitlements, such as healthcare and retirement. The unit also provides a critical service as the military's "leading identity management provider," which links active service members, employees, and contractors to credentials, such as smart cards and passwords. These are used to access Pentagon computer systems, buildings, and bases. "We make sure that the right people get access and the wrong people don't: security of identity information is paramount," the DMDC's website reads. The Department of Defense, which oversees the DMDC, said it does not have any indication that the information was misused, but did not say how it reached that conclusion. TechCrunch contacted a Pentagon spokesperson to ask if officials had any communications from the hackers, whose identities are not known, but we did not hear back.

Read more of this story at Slashdot.

[PROMO] Is anyone else dealing with spam through Better Messages rather than through registration?

30 September 2026 at 15:57

I've noticed that the usual anti-spam setup solves only part of the problem for community sites, particularly sites that use member plugins such as BuddyPress.

Registration can be protected with CAPTCHA, email verification and rate limiting, but once an account exists, private messaging becomes a separate attack surface.

I've seen patterns such as very new accounts contacting multiple members, sharing phone numbers or email addresses, moving people to WhatsApp/Telegram etc. and repeating essentially the same message across conversations. Often types like dating scams or crypto scams.

Out of sheer frustration with the lack of working solutions, I ended up building a small Better Messages-specific addon to deal with this message-level spam. The author of Better Messages has also looked at it and gave me some feedback on the implementation and I incorporated that feedback into the plugin.

The approach I choose was to apply new-account limits, detect contact details and external messenger links, detect repeated messages, show configurable safety warnings and notify admins. The checks can also be configured to log rather than block. My gut instinct to logging first turned out to be important, because security rules can have false positives and other nasty side effects. Being able to see what would have been blocked before actually blocking anything makes it much easier to tune the rules for actual situations, butnot bugging regular visitors while testing.

I'm not posting this because I think another generic anti-spam plugin is needed. The interesting part for me is whether message-level spam needs a different approach from registration spam.

If you run BuddyPress (or likewise) + Better Messages, I'd genuinely like to hear what you're seeing on your own sites. What types of spam are getting through your current setup? What are your biggest frustrations?

submitted by /u/Butterfly088
[link] [comments]

PMPRO integrations plugin with mollie

30 September 2026 at 13:55

Hi everyone,

I haven’t been able to find a suitable solution, so I’m asking here. I’m using the Paid Memberships Pro plugin on a blog site, currently connected to Stripe for recurring online payments. I now need to switch to Mollie.

Is there a plugin or integration that supports Mollie with Paid Memberships Pro? I haven’t been able to find one, and I’m not very experienced with coding. I could try building a custom integration with AI, but since this is for a client and I’m short on time, I’d prefer to avoid that if possible.

Any suggestions or solutions would be greatly appreciated!

submitted by /u/blackhathacker1602
[link] [comments]

[Promo] Built a 100% free plugin to switch off the WordPress features you don't use – and disable on every new site anyway!

30 September 2026 at 12:47

Hey r/Wordpress,

Like most of you, I found that every site I build ends up needing the exact same functions.php snippets: removing emoji scripts, killing XML-RPC, taming Heartbeat, dropping unnecessary image sizes, and hiding dashboard widgets.

I finally got tired of copying and pasting the same boilerplate, so I packaged it all into a single plugin called SlimPress.

It gives you 108 toggle switches across 13 categories. It is 100% free. There is no pro tier, no upsells, no admin nag banners, and zero telemetry.

What it covers

  • Front-end: Emoji scripts, generator tags, RSD/shortlink/REST links in <head>, global styles, core block CSS, Dashicons, and jQuery Migrate for visitors.
  • APIs & Core: XML-RPC, REST API for logged-out visitors (with a namespace allowlist), per-location Heartbeat control, WP-Cron on page load, oEmbed, and application passwords.
  • Comments & Feeds: Granular comment control (site-wide or per post type), pingbacks, Gravatar, feeds, author/date/attachment pages, and search.
  • Revisions & Media: Revision limits, autosave intervals, disabling the auto-generated 1536/2048px image copies, and managing custom image sizes.
  • Admin: Dashboard widgets, admin bar items, block editor extras, admin emails, auto-updates, and file editing.
  • WooCommerce (if active): Disables shop assets on non-shop pages, order attribution scripts, WC Analytics, the Marketing hub, marketplace suggestions, and controls Action Scheduler data retention.

Why I built this instead of using existing "disable bloat" plugins

Most optimization plugins overpromise or break things silently. I wanted a developer-first approach:

  • Honest Impact Badges: Every switch tells you exactly what it does, and more importantly, what it might break. It will even warn you if an active plugin relies on the off. If a toggle is just for tidying up the codeand won't actually speed up the site, the badge honestly says "None – cleanup only."
  • Built-in A/B Performance Testing: It loads your own pages with and without SlimPress's features in the same run. If the performance difference is too small to be meanins "within noise" instead of making up a fakescore. It also breaks down CSS/JS on each page by plugin, theme, and core to show exactly what can be removed.
  • Safe Defaults & Presets: Activating the plugin changes absolutely nothing – every switch starts off. You can apply presets (Blog, Brochure, Headless, WooCommerce) ld change before applying them.
  • Zero Footprint: It adds no CSS, JS, or markup to your public pages. Everything is done with runtime filters, so if you deactivate it, WordPress goes back to normal on g is permanently written to your core tables oroptions.

What it deliberately doesn't do

There is no caching, minification, "remove unuseiting. I also didn't include switches for thingsthat actively make sites slower or harder to cache (like removing ?ver= strings or disabling native lazy loading), even though other plugins sell those as "optimizations."

It requires WP 6.8+ and PHP 7.4+. WooCommerce is completely optional.

👉 SlimPress on the WordPress.org repo

I'd really appreciate some feedback from this coested in hearing if there are any switches youfeel are missing, or if you run into any edge cases where the "what might break" warning was inaccurate for your specific stack.

submitted by /u/Zaxxa
[link] [comments]

Google Reportedly Tests Paying Publishers For AI Search Results

By: BeauHD
30 September 2026 at 15:00
Google is reportedly testing a program that pays around 100 publishers based on how much their content contributes to its AI-powered search features. According to The Information, one publisher earned more than $1 million over a year, while another has received roughly $50,000 to $60,000." Digiday reports: Once a publisher joins the "AI contribution pilot," they receive an extra AI earnings widget via their Search Console dashboard. This displays a monthly earnings number (with some history), though no other detailed information on how payouts are calculated currently. Payments are based more on value than raw usage, meaning Google only pays when it judges that a piece of content has meaningfully contributed to an AI-generated response. Publishers can opt out at any time. [...] Digiday has learned that at least dozens of publishers have been approached by Google for the AI contribution pilot, though the program has been more appealing to small and mid-sized, rather than large publishers and has widened far beyond news publishers. Digiday couldn't get final confirmation of the number. Screenshots from Google Search Console, seen by Digiday, show an "AI contribution" panel that appears once a publisher opts into the program. The interface lists the program name and a monthly payout figure. "It's quite black box," as one exec with knowledge of the matter told Digiday. "Do I wish they were more transparent? Definitely," said one publisher exec who is in the program. "But I'm hopeful that the fact that they're setting a precedent for exploring paying publishers directly for content through this is meaningful," they added.

Read more of this story at Slashdot.

I tried using chatgpt instead of a basic crm

i’ve been messing around with using ChatGPT as a lightweight CRM / booking manager.

the set up I came up with: client data in Airtable, bookings to Google Calendar, Gmail for email. The nice part is obvious pretty quickly - instead of opening three tools aeparate apps and hunting around, I can just ask things like “who’s booked this week?”, “prepare a booking update”, “update their record”, “draft a follow-up”, “<client name> sent the deposit” etc.

But I didn’t really trust was the state of everything after a few changes. Say, a client reschedules over email, then I update the calendar event, then something gets updated in Airtable. at that point I want to know which system is actually right, whether all three match, and whether ChatGPT missed anything along the way.

once I started thinking about how to make that reliable, I ended up adding rules, checks, confirmations… which is basically the boring CRM stuff I was trying to avoid in the first place.

so TLDR: I wouldn’t use ChatGPT as the actual CRM. but as a lightweight CRM interface or booking manager sitting on top of the real systems, it actually makes a lot more sense to me.

wrote up the whole thing here if anyone’s interested: (apparently cant post it in the body, will try comments)

submitted by /u/greedy_tourist
[link] [comments]

im looking for someone who deals with LTL invoice rebills or random accessorial charges?

30 September 2026 at 09:51

I’ve been looking into how smaller companies handle freight invoices, especially LTL.

Curious if this is actually a common headache or if I’m overestimating it.

Stuff like:invoice comes in higher than the quote

reclass / reweigh charges

liftgate or limited access fees

duplicate or unexpected accessorials

When this happens, does someone on your team actually go back through the quote/BOL/POD and dispute it with the carrier?

Or do most companies just pay it unless the amount is obviously wrong?Would be really interested to hear how people actually deal with this in practice.


[link] [comments]

Reddit Is Killing RSS Feeds, Ending Public API Access

By: BeauHD
30 September 2026 at 14:00
An anonymous reader quotes a report from TechCrunch: Amid a number of updates for moderators and developers announced Wednesday comes bad news for supporters of a more open web: Reddit is ending support for RSS feeds. Reddit says RSS has now become a "common surface for large-scale scraping and automated abuse," which is why it's made the decision to wind down RSS feeds on its platform. "We know RSS has been a beloved part of the open web for a long time, and we're grateful to everyone who used it to stay connected to Reddit," the company noted in its announcement, where it also shared a March 2027 shutdown date for its public API. Reddit said RSS support will cease on November 13. [...] The RSS change was one of several updates issued on Wednesday by the company. Another big change will be the end of its public API. Public API access will also end by March 2027, which will impact any tools that used it for programmatic access to Reddit conversations, including social listening products, those used by researchers, and AI products, such as AI assistants. Today, those assistants can use Reddit to answer questions, but after closing public API access, they will need to forgo commercial deals with Reddit for its data. In addition, Reddit provided an update on its Rules Hub progress and auto-mod changes, and said it was "adding safeguards" to its classic, text-heavy version of its site known as Old Reddit. The latter will include limiting access to logged-in moderators and recent users -- changes Reddit also said were required because of "abusive scraping and automated traffic." Reddit said in the next few months it will limit access for logged-in users to those who have used Old Reddit in the last 90 days. The company also reminded developers building approved third-party apps and bots to register them with the company before January 12, 2027, to avoid disruption. After that date, Reddit will remove API access for any developer that hasn't registered.

Read more of this story at Slashdot.

Singapore Pilots a Government-Built Dating Service

By: BeauHD
30 September 2026 at 13:00
Longtime Slashdot reader AmiMoJo shares a report from Mashable: Singapore's government is trying its hand at matchmaking again. The country's Government Technology Agency (GovTech) has launched FirstDate, a pilot dating service for singles aged 21 to 35. For now, it's open only to public officers, according to the service's website. Applications close Oct. 5. FirstDate is designed as an alternative to endless swiping. Instead of browsing a stream of profiles, users fill out a questionnaire about their interests, habits, values, and preferences. The service then sends them one match per cycle (the time it takes to mutually accept and presumably meet up). Each match includes a compatibility score, a brief description of the person, and a personal note. [...] The pilot arrives as Singapore's birth rate hits a new low, according to the Singaporean newspaper The Straits Times. The country's total fertility rate fell to 0.87 children per woman in 2025, down from 1.24 a decade earlier. In April, the government announced a new workgroup tasked with addressing falling birth rates, which is expected to report its findings by early 2027, The Straits Times reported. The service relies on the Gale-Shapley algorithm, a well-known mathematical method that solves the stable matching problem by pairing two sets of participants based on their ranked preferences. Once matched, users have 72 hours to mutually accept before contact details are shared, with optional "Date Quests" and post-date surveys designed to encourage and assess in-person meetups. Accounts are verified through Singapore's Singpass digital ID system to reduce fake profiles, and profiles are only visible to assigned matches. GovTech says user data is protected under government security standards, is not sold to third parties, and can be deleted upon request.

Read more of this story at Slashdot.

Attackers Exploit Zimbra Flaw to Deploy Web Shells and Harvest Authentication Secrets

Threat actors have weaponized a now-patched security flaw in Zimbra Collaboration Suite (ZCS) to deploy web shells and access mailbox data, according to findings from the Microsoft Security Research team. The attack exploits CVE-2026-73570 (CVSS score: 8.9), an unauthenticated operating system command injection flaw that can lead to remote code execution when Simple Network Management Protocol

Attackers Abuse MSP360 to Deploy ScreenConnect in Dual-RMM Phishing Attacks

Microsoft has warned of phishing campaigns distributing an installer for the MSP360 Remote Monitoring and Management (RMM) software under the guise of meeting invitations, PDF-themed lures, software update prompts, and other social-engineering content. "Once executed, the legitimate MSP360 installer, distributed under a deceptive file name established remote management access on affected

❌