Security updates
Vulnerabilities and patches that server, WordPress, PHP, Laravel and mail admins should know about, by announcement date. Each post gives the severity, the fixed versions and how to fix it. Kept apart from the regular articles.
From official channels: CISA KEV, NVD, vendor advisories, Debian/Ubuntu security notices, GitHub/Packagist advisories · RSS
Nov 2026
WordPress Core Update Flaw CVE-2026-119977 Is Being Exploited
CVE-2026-119977 is a race condition in the WordPress core update process that CISA has confirmed is being exploited. It affects 4.7 through 7.1.3 and is fixed in 7.1.4 plus a backport on every branch. This note covers the severity, how to close wp-content/upgrade before updating, how to update every site, and how to check whether you were already hit.
Debian Security, Late Oct 2026: 12 DSAs Servers Should Apply
A roundup of Debian DSAs from 22 Oct. to 3 Nov. 2026 covering server-related packages only: unbound, brotli, pdns, valkey, varnish, imagemagick, nss, wordpress, php-mongodb, squid, linux and aide, with fixed versions for Debian 13 and commands to check versions and restart services
Oct 2026
2 GitLab CE/EE Flaws Exploited, Including CVE-2026-97229 (CVSS 10.0)
CISA added GitLab CVE-2026-85706 (unauthenticated file read) to KEV on 11 Sep and CVE-2026-97229 (unauthenticated code execution) on 29 Oct 2026. Both score CVSS 10.0. Upgrade to the latest patch release for your branch.
VMware ESX CVE-2026-41709 Exploited Logging Flaw Added to KEV Oct. 28
CVE-2026-41709 is an insufficient logging vulnerability in VMware ESX with a CVSS score of 2.7 (Low), but CISA added it to KEV on Oct. 28, 2026 because it has been exploited in the wild. Fixes are available in ESXi 9.1.0.0-25370933, 9.0.2.0100-25595025 or ESXi80U3j-25429389 (8.0 branch).
6 Linux Kernel Flaws in KEV Aug–Oct 2026—Reboot After Updating
CISA added 6 Linux kernel vulnerabilities to KEV between 26 Aug. and 28 Oct. 2026. Almost all allow privilege escalation from a regular account to root. Debian 13 has fixes in kernel 6.12.115-2 (DSA-6602-1), and a reboot is required for them to take effect.
Roundcube Fixes 20 Flaws (DSA-6579-1): Update to 1.6.20 or 1.7.5
Roundcube released 1.6.20 (LTS) and 1.7.5 on 19 Oct. 2026, fixing 20 vulnerabilities ranging from IMAP command injection, SSRF and XSS to header injection. Debian followed with DSA-6579-1 on 23 Oct. for Debian 13, while Debian 12 remains unfixed in the Debian tracker.
Laravel TokenGuard Bypass CVE-2026-114509, Livewire and Filament
Laravel issued a Critical advisory (CVSS v4 9.2) for TokenGuard, which can be tricked with non-string credentials, fixed in 12.68.0 and 13.29.0, plus a roundup of advisories for Livewire, Filament, league/commonmark, Symfony and phpseclib from Aug. to Oct. 2026
Two Critical PHP RCE Flaws (php2shell): Patch Today
CVE-2026-109618 and CVE-2026-109619 are PHP RCE vulnerabilities with a CVSS score of 9.2 and public exploits already available. They affect every machine using PHP to handle web requests. The patched versions are 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This note covers version checks, updates on Debian, RHEL, DirectAdmin, Docker, and Windows, and temporary settings while waiting for patches.
WordPress Plugins Exploited in Aug–Oct 2026 (Elementor Pro, etc.)
WordPress plugin vulnerabilities with reported exploitation or high scores from 5 Aug. to 5 Nov. 2026, including Elementor Pro CVE-2026-32475 (fixed in 4.2.2) and WooCommerce Wholesale Lead Capture CVE-2026-27540 (fixed in 2.0.3.2), plus two other high-scoring vulnerabilities with no reported exploitation
FortiMail CVE-2026-104286 and 3 Fortinet/PAN-OS CVEs Exploited
Fortinet and Palo Alto Networks have 4 vulnerabilities added to CISA KEV between 9 Sep. and 16 Oct. 2026. The most severe is FortiMail CVE-2026-104286, with CVSS 9.8 and no login required, fixed in 8.0.2, 7.6.7 and 7.4.9. PAN-OS CVE-2026-0322 has no workaround and requires an update to 12.2.4, 12.1.10-h2, 11.2.16, 11.1.16-h3 or 10.2.18-h12.
nginx 1.30.6/1.31.7 Fix 5 CVEs, Including CVE-2026-15176 (alias+rewrite)
nginx released stable 1.30.6 and mainline 1.31.7 on 14 Oct. 2026, fixing 5 medium-severity CVEs, from an alias and rewrite buffer overflow to HTTP/3 and TLS session tickets. The nginx.org advisory page lists 26 entries for 2026 in total.
Microsoft Patch Tuesday Oct. 2026: CVE-2026-96951 Exploited
Microsoft's Oct. 2026 patch release includes 1,474 CVEs, with Windows Shell CVE-2026-96951 (CVSS 8.8) actively exploited and already in CISA KEV. Windows Server 2025 is fixed in KB5126646, 2022 in KB5126655, and 2019 in KB5126651. There are also several Critical 9.8 vulnerabilities that require no authentication.
Ivanti Connect Secure: 3 CVEs Chained in Attacks, CVE-2026-104935
Ivanti Connect Secure has 3 vulnerabilities that have been chained together to gain root access without logging in. The first, CVE-2026-104935, has a CVSS score of 8.6 and entered CISA KEV on 13 Oct. 2026. The other two entered KEV on 30 Oct. The latest fixed versions are 25.1.1.3, 25.1.3.1 and 22.8R2.6.
BIND's 2015 CVE-2015-5477 Added to CISA KEV Oct. 2026; Check named Now
CISA added ISC BIND's TKEY vulnerability (CVE-2015-5477) to KEV on 8 Oct. 2026, meaning attackers are still exploiting old DNS servers. A single packet can terminate named. Fixed versions are 9.9.7-P2 and 9.10.2-P3 onward.
WordPress 7.1.3 Fixes 7 Flaws (XSS, SQLi, Data Leaks): Update Now
WordPress 7.1.3 was released on 6 Oct. 2026, fixing 7 security vulnerabilities, including second-order SQL injection in WXR export and unauthenticated disclosure of comments on private posts. The project urges immediate updates and provides backports for older branches down to 4.7.
Apache httpd 2.4.69 Fixes 20 CVEs, Moderate at Most—Update Soon
Apache HTTP Server 2.4.69, released on 1 Oct. 2026, fixes 20 vulnerabilities, rated moderate for 5 and low for 15. All affect versions up to 2.4.68; upgrading to 2.4.69 is required to get every fix.
Sep 2026
Citrix NetScaler: 5 Exploited Flaws, CVE-2026-88771 RCE
NetScaler ADC and Gateway have 5 CVEs added to CISA KEV between 26 Aug. and 4 Oct. 2026. The most severe are CVE-2026-88771 and CVE-2026-88772, both rated 9.5 under CVSS 4.0, which Citrix confirmed were exploited before disclosure. Builds covering all of them are 14.1-73.41 and 13.1-64.28 or later.
WordPress core CVE-2026-87902 exploited (KEV): update to 7.1.2 now
CVE-2026-87902 lets an unauthenticated attacker make WordPress include local PHP files outside the theme directory, leading to RCE when the required conditions are met. CISA added it to KEV on 25 Sep. 2026. Fixed versions include 7.1.2, 7.0.6, 6.9.9 and many older branches down to 4.7.37.
4 Windows Zero-Days Exploited Aug-Sep 2026 with IKE CVE-2026-33824
CISA added 4 Windows vulnerabilities to KEV during Aug-Sep 2026, namely AFD WinSock CVE-2026-68820, IKE CVE-2026-33824 (CVSS 9.8, remote), Windows Update Stack CVE-2026-81963 and ALPC CVE-2026-85880. The IKE patch was released on 14 Apr., but it was only added to KEV on 18 Aug.
Aug 2026
SharePoint on-prem CVE-2026-55040 and 65660 exploited; patch now
Two vulnerabilities in self-hosted SharePoint Server are on CISA's KEV list, CVE-2026-55040 (authentication bypass, CVSS 9.1, added 18 Aug.) and CVE-2026-65660 (code execution, CVSS 8.8, added 25 Sep.). Install the Aug. 2026 patch build or later. For Subscription Edition, that is 16.0.19725.20522.