Top Cybersecurity Articles of the Week: Linux Kernel TCP Flaw Leads Security NEXT Rankings
Security NEXT has released its list of the most-read articles for the week of November 1–7, 2026. The ranking reflects reader interest in newly disclosed vulnerabilities, vendor patches, and confirmed exploitation activity.
The top story concerns a serious vulnerability in the Linux kernel affecting IPv4 TCP connection processing. Researchers have already published proof-of-concept code demonstrating the issue.
Second place went to a remote code execution flaw in the WordPress update mechanism, prompting a warning from U.S. authorities about active exploitation attempts.
Chrome 157 addressed 213 vulnerabilities, seven of which were rated critical. The browser update was widely covered due to its broad impact on users.
Other notable entries include an update for Ruby on Rails fixing 21 vulnerabilities, multiple flaws in the database management tool pgAdmin 4 (two rated critical), and confirmed exploitation of Apple product vulnerabilities that triggered alerts from U.S. government agencies.
Additional stories covered patches in WordPress 7.1.4, an exploited GitLab issue traced to Ruby, ongoing remediation by QNAP for the PHP2Shell vulnerability, and a confirmed network intrusion at Japan’s Ministry of Foreign Affairs with potential personal data exposure.
Related articles
WordPress Core Update Flaw Draws Over 240,000 Attack Attempts Since Patch Release
Wordfence has blocked more than 240,000 attack attempts targeting a race condition vulnerability in the WordPress core update process, tracked as CVE-2026-119977 with a CVSS score of 8.1. The attempts began on October 28, the same day WordPress issued the fix, with a single-day peak exceeding 74,000 blocked requests. The flaw allows attackers to exploit predictable temporary upgrade files during the automatic core update, enabling them to complete an installation, create an administrator account, and upload malicious PHP code without any existing credentials. The vulnerability affects branches from version 4.7 through 7.1.3, with the fix available in 7.1.4 and backported releases for older lines. Because automatic updates are enabled by default on most sites, the exposure window opens silently during routine maintenance. Security researchers emphasize that the high volume of attempts does not confirm successful compromises, urging administrators to review user lists and modified files after any core update since late October.
Multiple Critical Vulnerabilities Found in OpenAM Identity Platform
Open Identity Platform disclosed 18 vulnerabilities in its OpenAM identity management platform on October 22, 2026. Three of these issues received the highest severity rating of Critical. The vulnerabilities were fixed in the OpenAM 16.1.4 release. One Critical flaw tracked as CVE-2026-123551 affects the WebSocket notification service used for session start and end events. Attackers can bypass authentication checks on WebSocket connections to leak user session tokens, enabling full session hijacking including for administrator accounts. V ulnCheck assigned a maximum CVSS v4.0 base score of 10.0 to this issue.
Analysis of 284 Major Russian Sites Reveals Widespread DMARC Misconfigurations, Outdated Libraries and Subdomain Takeover Risks
An automated scan of 284 large Russian websites found that 24 percent allow easy email spoofing because DMARC records are either missing or set to p=none. Nearly one quarter of readable sites still load JavaScript libraries such as jQuery versions from 2013-2016 that carry publicly known CVEs. Half the sites transmit visitor IP addresses and cookies to foreign analytics services despite privacy policies claiming otherwise. Five abandoned subdomains point to AWS and DigitalOcean addresses that could be claimed for phishing. Government sites performed no better than commercial ones on most checks. The researcher released the open-source Suveren tool so any organization can run the same tests against its own domains.
SonicWall SonicOS SSL VPN Authentication Bypass Vulnerability Under Active Exploitation
SonicWall disclosed seven vulnerabilities in its SonicOS operating system on November 6, 2026, including an authentication bypass flaw in the SSL VPN feature. The issue, tracked as CVE-2026-19868, affects environments where SAML authentication is enabled and allows attackers with valid credentials from another method to circumvent SAML controls. This bypass can also undermine multi-factor authentication enforced through SAML. The company has received reports indicating that the vulnerability is already being exploited in the wild. Both physical firewalls and virtual appliances are impacted, and SonicWall rates the flaw at CVSS 7.1. Users are urged to apply the available updates immediately.