Critical

CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

The Hacker News

November 4, 2026 at 5:43 AM

Actively Exploited

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are actively exploiting a significant security flaw in WordPress Core, which has been added to their Known Exploited Vulnerabilities catalog. This vulnerability, tracked as CVE-2026-119977, has a high severity rating of 8.1 and arises from a Time-of-check Time-of-use (TOCTOU) race condition. Attackers can exploit this flaw during software upgrades to execute arbitrary code, potentially compromising websites. Users and administrators of WordPress sites should be vigilant, as this vulnerability could allow unauthorized access and control over affected systems. It is crucial for those managing WordPress installations to take immediate action to safeguard their sites against these exploits.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: WordPress Core versions affected by CVE-2026-119977.
Action Required: Users should apply the latest security updates for WordPress Core as soon as they are available.
Timeline: Newly disclosed

Original Article Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code

Impact

WordPress Core versions affected by CVE-2026-119977.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Users should apply the latest security updates for WordPress Core as soon as they are available. Administrators are advised to review their upgrade processes to ensure they are not susceptible to TOCTOU race conditions.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Exploit, Vulnerability.

Read Original Article

Related Coverage

Malicious cPGuard Updates Served in OpsShield Supply Chain Attack

SecurityWeek

Attackers gained access to OpsShield's update servers using stolen credentials and manipulated several versions of cPGuard software. This supply chain attack allowed them to distribute malicious updates, potentially compromising systems that rely on cPGuard for security. Users of the affected cPGuard versions could be exposed to various security risks, as the malicious updates might allow unauthorized access or other forms of exploitation. Companies using OpsShield's services should take immediate action to secure their environments and review their update processes. This incident highlights the ongoing risks associated with supply chain vulnerabilities and the need for vigilant security practices.

Nov 4, 2026

Russian Police Arrest 3 Suspected VasyGrek Hackers, Dismantle Criminal Infrastructure

The Hacker News

Russian law enforcement has arrested three individuals suspected of being part of a hacker group called VasyGrek, also known as Fluffy Wolf. This group has been active since 2016 and is known for targeting both Russian and international companies, allegedly embezzling funds through cybercrime. The Ministry of Internal Affairs of the Russian Federation announced the arrests and the dismantling of the group's criminal infrastructure, which suggests a significant blow to their operations. This incident highlights ongoing cybersecurity challenges in the region and the need for continuous vigilance against such organized cybercrime. Companies operating in or with ties to Russia should remain alert to potential impacts from similar groups.

Nov 4, 2026

Google Issues Patches for Critical Android Flaw That Could Allow RCE Without User Interaction

The Hacker News

Google has issued a warning about a serious vulnerability in Android that could allow attackers to execute code on devices without any user interaction. This flaw, identified as CVE-2026-58868, affects devices running Android versions 14 through 17. Users of these Android versions should ensure their devices receive the latest security updates, specifically the patch level dated 2026-11-01 or later, which will be rolled out by phone manufacturers and carriers on their own schedules. The absence of a timely update could leave devices vulnerable to exploitation. As of November 4, 2023, there is no indication that this vulnerability is currently being exploited in the wild, but the risk remains significant for users who do not update their devices promptly.

Nov 4, 2026

Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach

darkreading

A significant data breach has occurred at the Philippine Overseas Employment Administration, where an unknown attacker managed to extract 69GB of SQL Server backups in less than 30 minutes. This breach likely compromises sensitive information related to migrant workers, raising serious concerns about their privacy and security. The incident underscores the vulnerability of government systems to cyberattacks, emphasizing the need for stronger cybersecurity measures to protect personal data. As the investigation unfolds, it remains critical for affected individuals to monitor their information and for the agency to enhance its defenses against future breaches. The swift nature of the attack highlights the potential risks associated with inadequate security protocols in handling sensitive data.

Nov 4, 2026

Hackers hijack cPGuard autoupdate to deploy backdoor, steal data

BleepingComputer

Hackers have compromised the update system of the cPGuard web security suite, allowing them to distribute a backdoor and a data-stealing script to users. This breach raises significant concerns as it potentially impacts numerous websites relying on cPGuard for security. The attackers exploited the autoupdate feature, which means that unsuspecting users may have unwittingly downloaded malicious code along with legitimate updates. This incident underscores the risks associated with software update mechanisms if not properly secured. Users and companies should immediately assess their systems for any signs of compromise and consider disabling automatic updates until a secure version is available.

Nov 3, 2026

Fresh European Fridge Attacks Put Cold-Chain Security in Focus

darkreading

Recent reports have highlighted vulnerabilities in internet-connected refrigerators in Europe, raising alarms about the security of cold-chain systems. These attacks exploit weak security practices and remote access features, posing risks not only to food storage but also to other critical temperature-sensitive infrastructure like pharmaceuticals and chemicals. Researchers warn that as more devices become interconnected, the potential for cyber incidents increases, endangering public health and safety. It’s crucial for companies managing these systems to improve their security measures to prevent exploitation. The ongoing nature of these attacks suggests a pressing need for enhanced protocols across various sectors.

Nov 3, 2026