--- title: GPT-5.6-Cyber ships with Daybreak Red tier, BdThemes... description: OpenAI released GPT-5.6-Cyber, a model that completed 95% of advanced security tasks in internal testing and already found two V8 flaws now patched as... canonical: https://daily.dev/posts/gpt-5-6-cyber-ships-with-daybreak-red-tier-bdthemes-supply-chain-attack-creates-rogue-wordpress-adm-v1gveuoyq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: GPT-5.6-Cyber ships with Daybreak Red tier, BdThemes supply-chain attack creates rogue WordPress admins | daily.dev og:description: OpenAI released GPT-5.6-Cyber, a model that completed 95% of advanced security tasks in internal testing and already found two V8 flaws now patched as... og:url: https://daily.dev/posts/gpt-5-6-cyber-ships-with-daybreak-red-tier-bdthemes-supply-chain-attack-creates-rogue-wordpress-adm-v1gveuoyq og:image: https://api.daily.dev/og/posts/v1GveUoyQ.png og:image:alt: GPT-5.6-Cyber ships with Daybreak Red tier, BdThemes supply-chain attack creates rogue WordPress admins og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # GPT-5.6-Cyber ships with Daybreak Red tier, BdThemes supply-chain attack creates rogue WordPress admins **[Security Digest](https://daily.dev/sources/security_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary OpenAI released GPT-5.6-Cyber, a model that completed 95% of advanced security tasks in internal testing and already found two V8 flaws now patched as CVE-2026-15903, distributed exclusively through an expanded Daybreak program with Blue and Red tiers. A supply-chain attack on BdThemes poisoned a remote JSON feed used by 100,000+ WordPress installs, creating hidden rogue admin accounts and dropping a webshell — the XSS vulnerability remains unpatched. CISA added two SonicWall SMA1000 CVEs to its KEV catalog with a three-day patch deadline for federal agencies, with over 380 appliances still exposed. Polish CERT disclosed a December 2025 OT breach where attackers pivoted through a misconfigured cellular APN to reach a WAGO PLC on default credentials, then put Siemens PLCs into STOP mode. ## Content **TLDR:** OpenAI released GPT-5.6-Cyber, a model that completed 95% of advanced security tasks in internal testing and already found two V8 flaws now patched as CVE-2026-15903, distributed exclusively through an expanded Daybreak program with Blue and Red tiers. A supply-chain attack on BdThemes poisoned a remote JSON feed used by 100,000+ WordPress installs, creating hidden rogue admin accounts and dropping a webshell — the XSS vulnerability remains unpatched. CISA added two SonicWall SMA1000 CVEs to its KEV catalog with a three-day patch deadline for federal agencies, with over 380 appliances still exposed. Polish CERT disclosed a December 2025 OT breach where attackers pivoted through a misconfigured cellular APN to reach a WAGO PLC on default credentials, then put Siemens PLCs into STOP mode. --- ## OpenAI releases GPT-5.6-Cyber, expands Daybreak into Blue and Red tiers GPT-5.6-Cyber completes 95% of advanced cybersecurity requests in internal testing — compared to 1.5-2% for standard Sol and 57.3% for its predecessor GPT-5.5-Cyber. In testing it found two previously unknown V8 flaws chainable to escape Chrome's heap sandbox, now patched as CVE-2026-15903, plus over 400 kernel privilege escalation issues. Access is gated through Daybreak Red, which requires identity verification, legal attestations, and hardware security keys mandatory for all personal accounts from September 1. Early partners include CrowdStrike, SentinelOne, Palo Alto Networks, Cisco, and Cloudflare. The uncomfortable tension: OpenAI is simultaneously a source of the offensive capability and the seller of the defense. [Read more](https://daily.dev/feed-by-ids?id=6zM684ii2&id=4A08DD726&id=5JJAJrMRJ) ## BdThemes supply-chain attack drops webshell across 100,000+ WordPress installs A threat actor compromised BdThemes' upstream infrastructure and poisoned a remote JSON feed used by the Biggop Library to deliver admin dashboard banners. An XSS flaw introduced in March 2026 let the attacker inject JavaScript that used authenticated admin sessions to create rogue administrator accounts hidden from the WordPress user list, then installed a fake plugin containing a webshell (emer-run.php) for persistence. The attack requires no user interaction and no plugin update — it's entirely API-driven. Affected plugins including Element Pack (100,000+ installs), Prime Slider, and Ultimate Post Kit were pulled from WordPress.org on August 8, but the XSS vulnerability is still unpatched. The C2 infrastructure links this actor to prior compromises of Advanced Responsive Video Embedder and OptinMonster. [Read more](https://daily.dev/posts/LFAhg18Ig) ## CISA orders federal agencies to patch SonicWall SMA1000 CVE-2026-15409 within three days CISA confirmed ransomware gangs are actively exploiting CVE-2026-15409, a maximum-severity SSRF in SonicWall SMA1000, alongside CVE-2026-15410. Volexity traced exploitation back to June 22, with threat actor UTA0533 deploying custom malware families including KNUCKLEBALL and ROOTRUN on vulnerable VPN appliances. Over 380 SMA1000 instances remain exposed online per Shadowserver. Federal agencies under BOD 26-04 have three days to patch; everyone else should treat this as urgent given the pattern of repeated SonicWall device compromises. [Read more](https://daily.dev/posts/X9E9RvfSr) ## Russian-linked attackers reached Polish heat plant OT network via misconfigured cellular APN Polish CERT disclosed a December 2025 attack on a combined heat-and-power plant serving 50,000 residents, attributed to the Electrum threat group. The attack path: compromise a FortiGate VPN at a nearby wind farm, pivot through a Teltonika cellular router into a private APN with no client isolation, find a WAGO PFC200 PLC on default credentials, enable SSH, and spend days mapping the OT environment. On December 29 the attackers put Siemens PLCs into STOP mode, locked them with new passwords, took down a steam turbine and water treatment system, then wiped logs on the way out. CERT Polska calls this the first documented real-world lateral movement through a private APN to reach an OT network — and the misconfiguration pattern is almost certainly not unique to Poland. [Read more](https://daily.dev/posts/D8gXypT8Q) --- ## Also notable - **Aeternum botnet uses Polygon smart contracts as C2, 29,000 detections recorded:** Unit 42 identified Aeternum, a C++ loader that queries public Polygon RPC endpoints to retrieve encrypted commands via the getDomain() function selector (0xb68d1809), making traditional law enforcement takedowns ineffective — Palo Alto Networks recorded over 29,000 detection events during the study period. [Read more](https://daily.dev/posts/6SoS54Pe7) - **CEVA Logistics breach exposes Steam, ING, Bol customer data from July 29–August 1 attack:** A cyberattack on Valve's European shipping contractor CEVA Logistics exposed names, home addresses, phone numbers, and Steam account emails for customers who ordered Steam Deck, Steam Machine, or Steam Controller hardware to European addresses — with Dutch retailers Bol and De Bijenkorf, ING, and Ajax also confirmed affected. [Read more](https://daily.dev/posts/Mln6OtnSE) - **Klaviyo sign-up page leaked plaintext passwords to Facebook, Google, and others for 21 months:** A misconfigured pixel tracker on Klaviyo's sign-up page sent new customers' email addresses and plaintext passwords to third-party advertisers including Facebook, Google, HubSpot, Microsoft, LinkedIn, and X for at least 21 months before being fixed. [Read more](https://daily.dev/posts/Qowqzboyk) - **iOS exploit chains Coruna and DarkSword proliferating into cybercrime, hybrid 'Darkuna' variants emerging:** iVerify tracked roughly 17,000 domains hosting second-generation variants of the Coruna and DarkSword iOS exploit chains — DarkSword targets iOS 18.4–18.7 using six CVEs, Coruna spans iOS 13–17.2.1 across 23 vulnerabilities — with threat actors now combining both into hybrid 'Darkuna' variants with improved jailbreak detection evasion and Telegram-focused implants. [Read more](https://daily.dev/posts/fhOEdhGDq) - **Progress LoadMaster CVE-2026-8037 actively exploited, ~300 instances still exposed:** CISA added CVE-2026-8037, an unauthenticated command injection flaw in Progress Kemp LoadMaster, to its KEV catalog — nearly 300 instances remain exposed online, and U.S. FCEB agencies have three days to patch under BOD 26-04. [Read more](https://daily.dev/posts/umQxqoB4r) ## Similar posts on daily.dev - [BdThemes plugins supply-chain hack creates rogue WordPress admins](https://daily.dev/posts/bdthemes-plugins-supply-chain-hack-creates-rogue-wordpress-admins-lfahg18ig) · BleepingComputer · 0 upvotes · 0 comments - [Daily OT Security News: September 23, 2026](https://daily.dev/posts/daily-ot-security-news-september-23-2026-vwdy21qxx) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#openai](https://daily.dev/tags/openai), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/gpt-5-6-cyber-ships-with-daybreak-red-tier-bdthemes-supply-chain-attack-creates-rogue-wordpress-adm-v1gveuoyq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/gpt-5-6-cyber-ships-with-daybreak-red-tier-bdthemes-supply-chain-attack-creates-rogue-wordpress-adm-v1gveuoyq","headline":"GPT-5.6-Cyber ships with Daybreak Red tier, BdThemes supply-chain attack creates rogue WordPress admins","text":"OpenAI released GPT-5.6-Cyber, a model that completed 95% of advanced security tasks in internal testing and already found two V8 flaws now patched as CVE-2026-15903, distributed exclusively through an expanded Daybreak program with Blue and Red tiers. A supply-chain attack on BdThemes poisoned a remote JSON feed used by 100,000+ WordPress installs, creating hidden rogue admin accounts and dropping a webshell — the XSS vulnerability remains unpatched. CISA added two SonicWall SMA1000 CVEs to its KEV catalog with a three-day patch deadline for federal agencies, with over 380 appliances still exposed. Polish CERT disclosed a December 2025 OT breach where attackers pivoted through a misconfigured cellular APN to reach a WAGO PLC on default credentials, then put Siemens PLCs into STOP mode.","url":"https://daily.dev/posts/gpt-5-6-cyber-ships-with-daybreak-red-tier-bdthemes-supply-chain-attack-creates-rogue-wordpress-adm-v1gveuoyq","datePublished":"2026-08-11T04:18:06.302Z","dateModified":"2026-08-11T04:18:38.619Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"GPT-5.6-Cyber ships with Daybreak Red tier, BdThemes supply-chain attack creates rogue WordPress admins"}]} ```