Twenty router models sold on Amazon, AliExpress, and Alibaba ship with a remote-control implant enabled by default. It runs as root, it uses no encryption, and it authenticates nobody. Whoever answers the phone owns the device.
Aimy Captcha-Less Form Guard: The Anti-Bot Plugin That Hands Bots the Keys
VulnCheck's Initial Access Intelligence team details an unauthenticated PHP object injection in the Aimy Captcha-Less Form Guard plugin for Joomla, where a repeating-key XOR published alongside its own ciphertext turns every protected form into an unserialize() sink and, on Joomla 3.9 through 5.2.1, into remote code execution.
VulnCheck State of Exploitation 1H-2026
Key Trends and Findings from Known Exploited Vulnerabilities, AI discovered vulnerabilities, and AI targeted technologies from the first half of 2026
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
