Three New Online Privacy Stories Uncovered

A recent review of web reporting reveals three new online privacy and computer‑security stories. The first story describes TerminalFix, a variant of ClickFix that uses fake Cloudflare CAPTCHAs to lure users into running malicious commands in Windows Terminal or PowerShell. Microsoft has disclosed details of this campaign, which increases the likelihood that victims will execute code via terminal interfaces rather than the traditional Run dialog.¹

The second report lists five critical security flaws affecting WordPress plugins and themes – WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. These vulnerabilities can lead to authentication bypass, account takeover, and arbitrary code execution. One flaw (CVE-2026-76581) carries a CVSS score of 9.8 and is found in the Pods plugin, which is estimated to be used by over 340 000 sites today. Security researchers from Wordfence and Patchstack have documented these issues, urging site owners to apply patches promptly.¹

The third story concerns Berlin’s state government refusing to pay hackers who stole data from the city’s administrative network after an August compromise. Officials said they would not meet extortionists’ demands and noted further data exfiltration involving the Senate Department for Mobility, Transport, Climate Protection and Environment. This refusal echoes past incidents where payment did not prevent ongoing damage, and German intelligence agencies view China as an active threat actor in critical infrastructure spaces.¹