01
Security
CISA Flags Active Exploitation of WordPress Core Upgrade Flaw CVE-2026-119977
Site operators running WordPress core upgrades face an unauthenticated code-execution risk until patches are applied.
Common Vulnerabilities and Exposures: the public catalogue that gives each known security flaw an identifier such as CVE-2026-12345, so everyone can refer to the same flaw.
A CVE number usually comes with a severity score from 0 to 10.
Site operators running WordPress core upgrades face an unauthenticated code-execution risk until patches are applied.
Node-RED instances that lack admin authentication can be taken over with a single request, and operators should check exposure now.
Phones on Android 14 through 17 need the security patch dated 2026-11-01 or later, and the second tranche must follow for kernel and chipset fixes.
Operators still on unpatched GitLab releases remain exposed, with more than 1,000 internet-facing servers yet to be fixed.
Organisations running exposed Connect Secure gateways face a backlog of unknown size, since fixes exist but how many devices have been secured is not known.
Phones on Android 12 and 13 remain exposed, and some devices may need a factory reset after repeated attacks.
Federal agencies face firm November deadlines to patch two flaws that attackers used with a third to take control of vulnerable VPN appliances.
Site owners on any release from 4.7 through 7.1.3 should update to 7.1.4, since attackers began probing the flaw within hours of its disclosure.
Servers running multipath TCP listeners face the highest risk until distributions ship kernel fixes for the flaw.
Servers running affected Linux kernels can be taken over as root by attackers who combine the flaw with PHP weaknesses, so patching is the immediate step.
Operators who build GitLab on their own Ruby or container images must patch Ruby as well as GitLab to close the hole.
Organizations running affected Cisco SD-WAN controllers should assume patching alone may not remove existing compromise.
Operators of internet-exposed management interfaces and Active Directory environments face the most immediate risk, with federal agencies facing a fixed patch deadline.
Targets include telecoms, government agencies and critical infrastructure, with California, Texas and Hawaii hit most often.
Neither vendor reports the bugs being exploited in the wild, but users should update promptly.
Operators who do not need network boot can turn PXE off while they wait for their firmware vendors to ship a fixed build.
Organisations running internet-exposed Oracle EBS instances face a remotely exploitable critical flaw that is now being probed, so the October patch matters now.
Security teams face a large testing load, and some users report the update broke Wi-Fi and VPN connections.
None were used in real attacks, and all were reported to vendors and patched, but outside readers cannot check how much of the work the model did alone.
Users should update Authenticator to version 6.2606.4246, since the fix does not say whether tokens already taken are revoked.