News

A flaw in TI WooCommerce Wishlist allows threat actors to upload arbitrary filesSince the files can be malicious, they could fully take over a websiteA patch is not yet released, so users should take careA critical-severity vulnerability in a popular WordPress plugin is possibly exposing hundreds of thousands of websites to different risks, including complete website takeover.Security researchers from Patchstack have claimed TI WooCommerce Wishlist carried an arbitrary file upload flaw, which allowed actors to upload malicious files to the underlying server without authentication.The vulnerability is now tracked as CVE-2025-47577, and has a severity score of 10/10 (critical).Reading the calendarThe TI WooCommerce Wishlist plugin is an extension for WooCommerce stores that allows users to create and manage wishlists, saving and sharing their favorite products.Besides the social sharing options, the plugin comes with AJAX-based functionality, multiple wishlist support in the premium version, email notifications, and more.According to The Hacker News, it has more than 100,000 active installations, meaning that the potential attack surface is rather large. To make matters worse, these are e-commerce sites, where visitors usually come to spend money, further compounding the risk.At press time, the newest version of the plugin is 2.9.2, last updated six months ago. Since the patch has not yet been released, users who fear an attack are advised to disable and remove the plugin until a fix is released.The silver lining here is that successful exploitation is only possible on websites that also have the WC Fields Factory plugin installed and running, and the integration is enabled on the TI WooCommerce Wishlist plugin.WC Fields Factory is a free WooCommerce plugin that allows store owners to add custom fields to product pages, variations, checkout forms, and the WordPress admin interface.It supports different field types such as text, number, email, date picker, and more. The plugin allows for dynamic pricing adjustments based on field inputs, field visibility rules, and role-based access controls, as well, and it offers a drag-and-drop form designer.You might also likeTop WordPress plugins found to have some serious security flaws, so make sure you're protectedTake a look at our guide to the best authenticator appWe've rounded up the best password managers

Meta has published the first of its quarterly integrity reports since Mark Zuckerberg walked back the company's hate speech policies and changed its approach to content moderation earlier this year. According to the reports, Facebook saw an uptick in violent content, bullying and harassment despite an overall decrease in the amount of content taken down by Meta.

The reports are the first time Meta has shared data about how Zuckerberg's decision to upend Meta's policies have played out on the platform used by billions of people. Notably, the company is spinning the changes as a victory, saying that it reduced its mistakes by half while the overall prevalence of content breaking its rules "largely remained unchanged for most problem areas."

There are two notable exceptions, however. Violent and graphic content increased from 0.06%-0.07% at the end of 2024 to .09% in the first quarter of 2025. Meta attributed the uptick to "an increase in sharing of violating content" as well as its own attempts to "reduce enforcement mistakes." Meta also saw a noted increase in the prevalence of bullying and harassment on Facebook, which increased from 0.06-0.07% at the end of 2024 to 0.07-0.08% at the start of 2025. Meta says this was due to an unspecified "spike" in violations in March. (Notably, this is a separate category from the company's hate speech policies, which were re-written to allow posts targeting immigrants and LGBTQ people.)

Those may sound like relatively tiny percentages, but even small increases can be noticeable for a platform like Facebook that sees billions of posts every day. (Meta describes its prevalence metric as an estimate of how often rule-breaking content appears on its platform.)

The report also underscores just how much less content Meta is taking down overall since it moved away from proactive enforcement of all but its most serious policies like child exploitation and terrorist content. Meta's report shows a significant decrease in the amount of Facebook posts removed for hateful content, for example, with just 3.4 million pieces of content "actioned" under the policy, the company's lowest figure since 2018. Spam removals also dropped precipitously from 730 million at the end of 2024 to just 366 million at the start of 2025. The number of fake accounts removed also declined notably on Facebook from 1.4 billion to 1 billion (Meta doesn't provide stats around fake account removals on Instagram.)

At the same time, Meta claims it's making far fewer content moderation mistakes, which was one of Zuckerberg's main justifications for his decision to end proactive moderation."We saw a roughly 50% reduction in enforcement mistakes on our platforms in the United States from Q4 2024 to Q1 2025," the company wrote in an update to its January post announcing its policy changes. Meta didn't explain how it calculated that figure, but said future reports would "include metrics on our mistakes so that people can track our progress."

Meta is acknowledging, however, that there is at least one group where some proactive moderation is still necessary: teens. "At the same time, we remain committed to ensuring teens on our platforms are having the safest experience possible," the company wrote. "That’s why, for teens, we’ll also continue to proactively hide other types of harmful content, like bullying." Meta has been rolling out "teen accounts" for the last several months, which should make it easier to filter content specifically for younger users.

The company also offered an update on how it's using large language models to aid in its content moderation efforts. "Upon further testing, we are beginning to see LLMs operating beyond that of human performance for select policy areas," Meta writes. "We’re also using LLMs to remove content from review queues in certain circumstances when we’re highly confident it does not violate our policies."

The other major component to Zuckerberg's policy changes was an end of Meta's fact-checking partnerships in the United States. The company began rolling out its own version of Community Notes to Facebook, Instagram and Threads earlier this year, and has since expanded the effort to Reels and Threads replies. Meta didn't offer any insight into how effective its new crowd-sourced approach to fact-checking might be or how often notes are appearing on its platform, though it promised updates in the coming months.This article originally appeared on Engadget at https://www.engadget.com/social-media/facebook-sees-rise-in-violent-content-and-harassment-after-policy-changes-182651544.html?src=rss

Meta is bidding to build high-tech wearables for the US Army, as reported by Wall Street Journal. The company is teaming up with Palmer Luckey's defense firm Anduril Industries on the project, which has been dubbed EagleEye. The contract is worth around $100 million, though it hasn't been awarded yet. It's part of a larger $22 billion Army wearables project of which Anduril is the lead vendor.

As expected from Meta and Luckey, EagleEye will be a line of tech-forward helmets, glasses and other wearables that provide an augmented reality or virtual reality experience. Reporting indicates that these devices will include sensors that enhance the hearing and vision of soldiers. Meta CEO Mark Zuckerberg said in a statement that this tech will “protect our interests at home and abroad.”

Anduril and Meta have teamed up to make the world's best AR and VR systems for the United States Military. Leveraging Meta's massive investments in XR technology for our troops will save countless lives and dollars. pic.twitter.com/t9d2vRInSe— Palmer Luckey (@PalmerLuckey) May 29, 2025

This could be used to detect drones flying miles away, for instance, or to suss out hidden targets. It'll also allow these soldiers to interact with AI-powered weapon systems, as Anduril's autonomy software and Meta's AI models will underpin each device. This all sounds very dystopian, but such are the times we find ourselves in.

“I have successfully persuaded not just Meta but many others that working with the military is important," Palmer Luckey said in an interview, speaking on Big Tech's embrace of defense contract work. He's become a big player in the defense space in recent years, securing $6 billion in global government contracts and partnering up with many of the tech world's major players.

"I've always said that we need to transition from being the world police to being the world gun store," he said in a recent interview with CBS News. Luckey is a long-time supporter of President Trump and recently said that Anduril "did well under Trump in his first administration" and that he thinks the company is "going to do even better now."

This is something of a homecoming for Luckey. He co-founded Oculus VR, which Meta purchased. He was fired back in 2017 after news broke that he donated $10,000 to a group trying to install 4chan-style anti-Hillary Clinton memes on roadside billboards. Zuckerberg has since cozied up to Trump in various ways, so I guess the two can be friends again or whatever. “I finally got all my toys back,” Luckey told WSJ.This article originally appeared on Engadget at https://www.engadget.com/big-tech/meta-could-soon-start-building-tech-for-the-us-army-184405058.html?src=rss