❌

Visualização normal

Antes de ontemStream principal
  • ✇Firewall Daily – The Cyber Express
  • Hackers Exploit WordPress Flaw Within 48 Hours of Security Patch Ashish Khaitan
    Attackers needed less than two days to start going after a freshly patched WordPress vulnerability. The flaw sits in WordPress core itself, and it can let an attacker run code on a website while that site is installing an update.  WordPress shipped version 7.1.4 on October 28, 2026, to close the hole. Within 48 hours of that release, exploitation attempts were already underway. Security firm Wordfence said it blocked 62,969 attacks aimed at this vulnerability in WordPress over a single 24-hou
     
  • ↗️

Hackers Exploit WordPress Flaw Within 48 Hours of Security Patch

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan
3 de Novembro de 2026, 10:25

WordPress vulnerability

Attackers needed less than two days to start going after a freshly patched WordPress vulnerability. The flaw sits in WordPress core itself, and it can let an attacker run code on a website while that site is installing an update.  WordPress shipped version 7.1.4 on October 28, 2026, to close the hole. Within 48 hours of that release, exploitation attempts were already underway. Security firm Wordfence said it blocked 62,969 attacks aimed at this vulnerability in WordPress over a single 24-hour period.  Anyone running WordPress for a business, a nonprofit, or a healthcare facility is being urged to update right away. 

What WordPress 7.1.4 Fixes Beyond the WordPress Vulnerability 

Version 7.1.4, released on October 28, is mainly a security release. Alongside the critical code execution fix, it patches several stored cross-site scripting (XSS) flaws, a denial-of-service issue, and two separate information leaks.  The update also refreshes WordPress's bundled root certificates after eMudhra revoked its certificates. Of everything in the release, the code execution bug is the one attackers zeroed in on.  Aaron Jorbin, who wrote the release announcement, told users to “update your sites without delay.”  A GitHub security advisory published the next day described the issue as a timing weakness in the update system. If an unauthorized user moves quickly enough while an upgrade is running, they may be able to execute their own code on the server. No CVE number has been assigned to it so far. 

How the Vulnerability in WordPress Works 

When WordPress performs a full-package core update, it first extracts the new files into a dedicated directory inside the upgrade folder. According to the advisory, that directory had a predictable name and was reachable from the public web.  That combination is the problem. An attacker who requests the right file at the right moment, before WordPress finishes cleaning up, could trick the server into running arbitrary PHP code.  Pulling this off is not trivial. The attacker needs four conditions to line up: a full-package update in progress, web access to the temporary folder, a path they can guess, and a short window before the files are deleted. Under controlled conditions, that window may last only a few seconds. 

Which Sites the WordPress Vulnerability Affects 

The advisory lists every WordPress release from 4.7 through 7.1.3 as vulnerable. It also names the fixed version for each branch, including 7.0.8, 6.9.11, 6.8.12 and 5.9.20.  The WordPress project said it backported the patch to all branches still receiving security maintenance, reaching as far back as 4.7. It also stressed that only the newest version is actively supported.  Not every site can be taken over through this bug. The risk rises sharply, however, if an attacker hits a site while it is running a full-package update.  Smaller websites face extra exposure. Many sit on shared servers with default settings, which makes them attractive targets for cybercriminals. 

How Attackers Are Targeting the Vulnerability in WordPress 

Wordfence traced the root cause to full-package upgrades repeatedly using web-accessible paths that are easy to guess. Alex Thomas, a threat analyst at Wordfence, said attackers quickly understood the race condition and turned their attention to it.  Two of the biggest attack sources reportedly kept polling small groups of websites for roughly 14.5 hours. Other sources tried out different folder names and version names.  The pattern looks like large-scale automated guessing rather than attacks on chosen victims. So far, no confirmed reports have put a number on how many sites have actually been compromised. 

How Serious Is This WordPress Vulnerability? 

Sources disagree on how severe the flaw is. The Hacker News gave it a CVSS score of 8.1, which falls in the high range. The GitHub advisory, by contrast, rates it as low severity.  That gap most likely comes down to how hard the bug is to exploit successfully. Even so, the sheer volume of attack attempts and the simplicity of the fix make it sensible to treat this as a serious threat. 

What Comes Next for This Vulnerability in WordPress 

The probing is unlikely to stop soon. Once a vulnerability is patched, the fix itself becomes a detailed roadmap for anyone hunting sites that have not been updated.  The WordPress project says backports to older branches are still in progress. The next major release, WordPress 7.2, is scheduled for December 8.  The advisory credits researcher Umut Bayram with discovering the flaw and reporting it responsibly. There is currently no alternative workaround, so applying the patch is the only fix available. 
  • ✇Cybersecurity News
  • WordPress Core Vulnerability Exploited in the Wild Do Son
    A critical WordPress Core vulnerability is exploited in the wild. Update to WordPress 7.1.4 immediately to fix the unauthenticated race condition RCE. Related Posts: Android SMS of Death Bug Triggers Remote Reboots JetBrains Patches Critical Flaws in IDEs and Background Services After Certificate Breach CERT/CC Warns of Xerj Authentication Bypass Flaw CVE-2026-97406 The post WordPress Core Vulnerability Exploited in the Wild appeared first on Daily CyberSecurity.
     
  • ↗️

WordPress Core Vulnerability Exploited in the Wild

✇Cybersecurity News
Por:Do Son
30 de Outubro de 2026, 00:31

A critical WordPress Core vulnerability is exploited in the wild. Update to WordPress 7.1.4 immediately to fix the unauthenticated race condition RCE.

Related Posts:

The post WordPress Core Vulnerability Exploited in the Wild appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Version 3.0.123 Do Son
    Update Rank Math SEO PRO to 3.0.124 now. CVE-2026-111862 is a critical supply-chain compromise actively exploited in the wild via embedded malware. Related Posts: Roundcube 1.6.20 and 1.7.5 Fix 20 Security Flaws, Including IMAP Command Injection PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host CISA Warns of Critical Flaws in dcm4chee Medical Archive and Unpatched EseeCloud IP Cameras The post Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Versi
     
  • ↗️

Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Version 3.0.123

✇Cybersecurity News
Por:Do Son
17 de Outubro de 2026, 01:15

Update Rank Math SEO PRO to 3.0.124 now. CVE-2026-111862 is a critical supply-chain compromise actively exploited in the wild via embedded malware.

Related Posts:

The post Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Version 3.0.123 appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • Backuply WordPress Plugin Patched for High-Severity SQL Injection Vulnerability Do Son
    Update the Backuply WordPress plugin to 1.5.9 to fix CVE-2026-93953, a high-severity SQL injection vulnerability impacting 600,000 sites. Related Posts: Roundcube 1.6.20 and 1.7.5 Fix 20 Security Flaws, Including IMAP Command Injection PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host CISA Warns of Critical Flaws in dcm4chee Medical Archive and Unpatched EseeCloud IP Cameras The post Backuply WordPress Plugin Patched for High-Severity SQL Injection Vulnerability app
     
  • ↗️

Backuply WordPress Plugin Patched for High-Severity SQL Injection Vulnerability

✇Cybersecurity News
Por:Do Son
15 de Outubro de 2026, 21:49

Update the Backuply WordPress plugin to 1.5.9 to fix CVE-2026-93953, a high-severity SQL injection vulnerability impacting 600,000 sites.

Related Posts:

The post Backuply WordPress Plugin Patched for High-Severity SQL Injection Vulnerability appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploaded PDFs Into Remote Code Execution Do Son
    A critical Ghostscript vulnerability, CVE-2026-39919 (CVSS 9.8), allows remote code execution via crafted PDFs. Update Ghostscript to 10.08.0 now. Related Posts: SAP Security Patch Day October 2026 Fixes CVSS 10 Cloud SDK Flaw and Three More Critical Bugs IBM Patches Three Critical Flaws in IBM i, Db2 Mirror and Maximo AI Service Discourse Vulnerabilities Let Attackers Hijack Pages for Every Visitor and Read Server Files The post Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploade
     
  • ↗️

Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploaded PDFs Into Remote Code Execution

✇Cybersecurity News
Por:Do Son
12 de Outubro de 2026, 17:19

A critical Ghostscript vulnerability, CVE-2026-39919 (CVSS 9.8), allows remote code execution via crafted PDFs. Update Ghostscript to 10.08.0 now.

Related Posts:

The post Critical Ghostscript Vulnerability CVE-2026-39919 Turns Uploaded PDFs Into Remote Code Execution appeared first on Daily CyberSecurity.

  • ✇Cybersecurity News
  • WordPress Must-Use Plugin Malware Uses EtherHiding Do Son
    Wordfence uncovered stealthy WordPress must-use plugin malware. Learn how this WordPress must-use plugin malware abuses EtherHiding to steal secrets. Related Posts: Malicious Terraform Providers Spread Graphalgo Go Malware CLOSEDQUORUM AI Malware Uses LLMs for Autonomous C2 New TASK#STOMP PowerShell Backdoor Targets Windows The post WordPress Must-Use Plugin Malware Uses EtherHiding appeared first on Daily CyberSecurity.
     
  • ↗️

WordPress Must-Use Plugin Malware Uses EtherHiding

✇Cybersecurity News
Por:Do Son
25 de Setembro de 2026, 03:30

Wordfence uncovered stealthy WordPress must-use plugin malware. Learn how this WordPress must-use plugin malware abuses EtherHiding to steal secrets.

Related Posts:

The post WordPress Must-Use Plugin Malware Uses EtherHiding appeared first on Daily CyberSecurity.

Wordfence Finds Critical Backdoor in ARVE WordPress Plugin

✇Hackread – Latest Cybersecurity, Tech, Crypto & Hacking News
Por:Waqas
31 de Julho de 2026, 10:07
A backdoored ARVE WordPress Plugin release could grant attackers administrator access with one token, but WordPress.org blocked automatic distribution to WordPress sites.
❌
❌