VulnerabilitiesCVE-2026-119618CVSS 8.14 min read
Apache HTTP Server 2.4.71 fixes a race condition in mod_http2 that Red Hat scored 9.8, reported independently by Anthropic's OSS Scanner and Google researchers. Only servers with HTTP/2 enabled are affected.
VulnerabilitiesBrief2 min read
A researcher says the update that patches an actively exploited WordPress flaw still unpacks its files using the site's old, unpatched code, leaving a window for an attacker who times it right.
VulnerabilitiesExploitedCVE-2026-119977CVSS 8.12 min read
The bug is a race condition in full-package core upgrades that can let an unauthenticated attacker run code on the server during the upgrade window. CISA set a November 6 remediation deadline.
VulnerabilitiesCVE-2026-81648CVSS 10.01 min read
Defused Cyber says exploitation attempts are hitting a maximum-severity bug in the WordPress plugin, which can let unauthenticated users delete files and pull wallet credentials.
VulnerabilitiesExploitedCVE-2026-109618CVSS 9.22 min read
A China-linked group chained the PHP flaws with a kernel privilege-escalation bug to get root on PAN-OS devices, while mass scanning against WordPress has yet to produce confirmed compromises.
VulnerabilitiesBrief2 min read
Defiant says threat actors began hitting a race condition in WordPress's update process within hours of the fix, though the exploit window is narrow and no successful compromises are reported.
IncidentsBrief2 min read
Some version 3.0.123 packages carried malware that could hand attackers control of a site once the plugin was activated, Rank Math says.
IncidentsBrief2 min read
Rank Math says copies of its paid WordPress SEO plugin downloaded or pushed as updates during a roughly 11-hour window contained malware, and that affected sites should be treated as compromised.
