Posts Tagged ‘wordpress’
Top 5 Cybersecurity News
This week’s Top 5 Cybersecurity News for November 6, 2026 follows five routine acts that turned into the way in. A fake job interview got an engineer to run a code test on a Binance work laptop, and about $6.3 billion followed. Stored backup credentials gave a ransomware affiliate a school estate, in an attack…
Read MoreWordPress Core RCE Vulnerability Hits Core Updates
A WordPress core RCE vulnerability can be triggered while a site updates itself: during a full core upgrade, the new files sit for a short time in a predictable folder that anyone can request. Wordfence assigned it CVE-2026-119977 (CVSS 8.1), and CISA added it to the Known Exploited Vulnerabilities catalog on November 3 with a…
Read MoreRank Math Supply Chain Attack Hits WordPress
A Rank Math supply chain attack put malware into the premium plugin’s update channel: version 3.0.123 of Rank Math PRO, downloaded or updated between October 15 (20:02 UTC) and October 16 (07:12 UTC), contained a backdoor. The window lasted about 11 hours. The vendor’s clean build is 3.0.124, and the free plugin from WordPress.org is…
Read MorePHP Critical Vulnerabilities Leaked Before Patch
Two critical PHP vulnerabilities leaked before their patch, early attacks are reported, and the EU’s CERT says internet-facing applications may need to be isolated until it is installed. PHP’s security team released the fix on October 21 at 14:00 UTC (16:00 CEST). Both flaws are rated CVSS v4.0 9.2, and researchers report remote code execution.…
Read MoreminiOrange SAML SSO Bypass Vulnerability
A miniOrange SAML SSO bypass is under active exploitation against WordPress sites, and most vulnerability scanners cannot detect whether a given site is actually affected. Two chained authentication bugs, CVE-2026-61979 and CVE-2026-15981 (CVSS 9.8 each), let an unauthenticated attacker forge a SAML login and access wp-admin as any existing user, including administrators. DigitalOcean confirmed exploitation…
Read More