We’re launching Lyria 3.5 in Google Flow Music, with advances across musicality, lyrics, vocals, and creative control
deepmind.google·6d ago
AI Engineering
Hacker News·Jun 17·5 min read
Most of the CVE-2026-4020 attackers are the same client
TL;DR
A vulnerability in the Gravity SMTP plugin for WordPress allowed unauthorized access to sensitive data. Attackers exploited this flaw using a fleet of Google Cloud instances, disguising themselves with 3,299 rotating user-agent strings.
✦ Why It Matters
Engineers should enhance detection mechanisms to identify sophisticated attack patterns that use IP and user-agent rotation.
Key Takeaways
- Implement advanced detection for HTTP request patterns.
- Monitor for unusual user-agent string rotations.
- Analyze traffic across multiple IPs for coordinated attacks.
- Regularly update and patch known vulnerabilities.
Full Summary
The Gravity SMTP plugin for WordPress contained a vulnerability (CVE-2026-4020) that exposed sensitive SMTP credentials through an unauthenticated REST endpoint. Attackers leveraged this flaw using a large fleet of Google Cloud instances, employing a technique that involved rotating user-agent strings to mask their identity.
A JA4H hash, which represents the unique characteristics of an HTTP request, was used to identify the attackers, revealing that 99.1% of the 566 logged IPs shared the same fingerprint. This operation spanned 3,158 source IPs across 92 networks and 43 countries, indicating a sophisticated approach to evade detection.
The attackers targeted over 36,000 ports to collect sensitive files, demonstrating a high level of organization. The findings suggest that traditional filtering methods based on IP and user-agent are insufficient for detecting such coordinated attacks.