WordPress Core Update Flaw Draws Over 240,000 Attack Attempts Since Patch Release
Wordfence has blocked more than 240,000 attack attempts against a flaw in the WordPress core update process since October 28. The vulnerability, registered as CVE-2026-119977 and rated 8.1 out of 10, resides in the full core upgrade routine.
During an update, installation files are extracted into a temporary upgrade folder whose names are predictable and publicly reachable. This creates a race condition lasting several seconds between the moment the file is written and the moment it is used by the legitimate process.
Within that window an attacker who knows the location can reach the exposed installer and finish the installation steps as if they were the site administrator. The next actions include creating a new administrator account and uploading malicious PHP code, all without requiring any existing account or user interaction.
The blocked requests represent firewall activity only and do not indicate successful infections. A high attempt count therefore does not reveal how many sites were actually compromised.
Affected branches range from version 4.7 to 7.1.3. The correction is included in 7.1.4, and older branches received backported fixes. Only the most recent branch receives active support, making a version upgrade the safest long-term option.
Administrators are advised to install 7.1.4 or the corrected release for their branch, verify that automatic updates completed successfully, and restrict public access to PHP files inside the upgrade directory as an additional mitigation during the update window.
Any site that performed a core update since October 28 should review its administrator list and inspect modified PHP files for unauthorized changes.
Related articles
Multiple Critical Vulnerabilities Found in OpenAM Identity Platform
Open Identity Platform disclosed 18 vulnerabilities in its OpenAM identity management platform on October 22, 2026. Three of these issues received the highest severity rating of Critical. The vulnerabilities were fixed in the OpenAM 16.1.4 release. One Critical flaw tracked as CVE-2026-123551 affects the WebSocket notification service used for session start and end events. Attackers can bypass authentication checks on WebSocket connections to leak user session tokens, enabling full session hijacking including for administrator accounts. V ulnCheck assigned a maximum CVSS v4.0 base score of 10.0 to this issue.
Analysis of 284 Major Russian Sites Reveals Widespread DMARC Misconfigurations, Outdated Libraries and Subdomain Takeover Risks
An automated scan of 284 large Russian websites found that 24 percent allow easy email spoofing because DMARC records are either missing or set to p=none. Nearly one quarter of readable sites still load JavaScript libraries such as jQuery versions from 2013-2016 that carry publicly known CVEs. Half the sites transmit visitor IP addresses and cookies to foreign analytics services despite privacy policies claiming otherwise. Five abandoned subdomains point to AWS and DigitalOcean addresses that could be claimed for phishing. Government sites performed no better than commercial ones on most checks. The researcher released the open-source Suveren tool so any organization can run the same tests against its own domains.
Top Cybersecurity Articles of the Week: Linux Kernel TCP Flaw Leads Security NEXT Rankings
Security NEXT has published its weekly ranking of the most-read articles for the period of November 1 to November 7, 2026. The list is dominated by critical vulnerability disclosures and patches across widely used platforms. Leading the chart is a severe flaw in the Linux kernel's IPv4 TCP connection handling that has already attracted proof-of-concept reports. Other prominent entries include remote code execution issues in WordPress, hundreds of fixes in Chrome 157, and multiple critical vulnerabilities in pgAdmin 4. The ranking also highlights confirmed exploitation of Apple product vulnerabilities and a network intrusion at Japan's Ministry of Foreign Affairs that may have exposed personal data.
SonicWall SonicOS SSL VPN Authentication Bypass Vulnerability Under Active Exploitation
SonicWall disclosed seven vulnerabilities in its SonicOS operating system on November 6, 2026, including an authentication bypass flaw in the SSL VPN feature. The issue, tracked as CVE-2026-19868, affects environments where SAML authentication is enabled and allows attackers with valid credentials from another method to circumvent SAML controls. This bypass can also undermine multi-factor authentication enforced through SAML. The company has received reports indicating that the vulnerability is already being exploited in the wild. Both physical firewalls and virtual appliances are impacted, and SonicWall rates the flaw at CVSS 7.1. Users are urged to apply the available updates immediately.