Thursday’s brief: WordPress under fire, then Tomcat, Palo Alto, SAP

Published: 09/24/26

Thursday’s brief starts with WordPress, where attackers went from probing to writing PHP on unpatched hosts in under a day. After that: a Tomcat WebSocket restriction that attackers can get around, a Palo Alto firewall bug the vendor rates HIGHEST urgency, and SAP’s OVERPASS kernel flaw, which now has public proof-of-concept code.

Lead Story

WordPress under active attack — patch Core before Friday

CVE-2026-87902 lets an unauthenticated attacker include a local PHP file via page-template resolution. Patchstack watched reconnaissance start hours after 7.1.2 shipped on September 22; by September 23 operators were using pearcmd to drop shell tags and Nuclei templates were public. Fixed releases go back to 4.7.37. Check the version on disk today.

Why every site counts: The scanning is automated and WordPress runs on a huge number of sites, so a bug that needs specific conditions still finds plenty of targets. That forgotten marketing site counts too.

See the patch list →

Also Worth Your Attention

Tomcat WebSocket lock can be walked around

CVE-2026-76183 (disclosed September 23) lets attackers evade security constraints on WebSocket endpoints via an alternate name. Upgrade to 11.0.26, 10.1.60, or 9.0.122; migrate off end-of-support 8.5/7.

Who relies on it: Live consoles and admin UIs often depend on that constraint to keep outsiders off their WebSocket endpoints.

Upgrade path →

Palo Alto says HIGHEST urgency — root risk on PA-Series

CVE-2026-0310 is an unauthenticated XML buffer overflow with vendor urgency HIGHEST. PA-Series faces root RCE; VM-Series mostly denial of service; Panorama is in scope. There is no known exploitation yet, so patch while that holds. Restrict management to a jump box and take the exact fixed builds.

What root gets an attacker: control of the firewall’s policy and its VPN.

Use the window →

SAP’s CVSS 10 kernel bug now has public PoCs

CVE-2026-44756 (Note 3747649) is pre-auth RCE via Extended Passport processing across HTTP, GUI, and RFC. S4GET (CVE-2026-58240) hits Message Server registration. The SAPMAP toolkit now includes proof-of-concept exploits. Patch internet-facing SAP first, then every internal app server.

Before login: The bug sits in shared kernel code, so it is reachable over HTTP, GUI and RFC. Role checks do not help because it runs before anyone logs in.

PoC clock →

Patch WP Core today; inventory Tomcat WS; lock PAN-OS mgmt; OVERPASS on Internet-facing SAP.

Go Deeper

Related reading: Cybersecurity Tools · Cyber Attacks on Critical Infrastructure · Get the Daily Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].