I was reporter #11 for a WPForms PayPal webhook vulnerability (CVE-2026-4986)

We probed 6,000 web apps for Stripe webhook signature checks. 1,542 don't bother

APT28 Targeted European Entities Using Webhook-Based Macro Malware