Daily Brief

Attackers are polling for the WordPress update bug we flagged. Block one folder and confirm 7.1.4

Attackers are polling for the WordPress update bug we flagged. Block one folder and confirm 7.1.4

WordPress core CVE-2026-119977 (4.7 to 7.1.3) lets attackers run code during a core update. Wordfence logged tens of thousands of attempts. Fixed releases, wp-content/upgrade block and log checks.
Ivanti VPN owners: the root bug from October’s attacks now has a fix, and CISA’s deadline is today

Ivanti VPN owners: the root bug from October’s attacks now has a fix, and CISA’s deadline is today

Ivanti Connect Secure CVE-2026-111357, the dsinvoked root escalation chained in October attacks, is on CISA KEV due Nov 2. Fixed builds 22.8R2.6, 25.1.1.3, 25.1.3.1 and hunt steps.
Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware

Friday’s brief: Cisco VPN firewalls under attack, then GitLab, Synology NAS ransomware and Cisco SD-WAN spyware

Cisco ASA and FTD CVE-2026-76418 VPN zero-day on CISA KEV, GitLab CVE-2026-97229 on KEV with an Alpine Linux incident, Synology C3RB3R ransomware and Cisco SD-WAN KeyDrift.
Spies sat inside Cisco SD-WAN controllers and copied the encryption keys. Check yours is patched and clean

Spies sat inside Cisco SD-WAN controllers and copied the encryption keys. Check yours is patched and clean

Cisco Talos reports UAT-11473 used SD-WAN bypass CVE-2026-20127 to plant KeyDrift, which copies IPsec key material. Fixed releases, files to check and what to rotate.
Ransomware is locking Synology NAS boxes that skipped September’s update. Check your DSM version today

Ransomware is locking Synology NAS boxes that skipped September’s update. Check your DSM version today

C3RB3R (Cerber) ransomware is encrypting Synology NAS devices via DSM flaws CVE-2026-13639 and CVE-2026-13684, fixed Sept 18. Fixed DSM versions, backups and hunt steps.
The GitLab bug we flagged is now on CISA’s exploited list, and Alpine Linux’s upgrade did not fix it

The GitLab bug we flagged is now on CISA’s exploited list, and Alpine Linux’s upgrade did not fix it

CISA added GitLab CVE-2026-97229 to KEV on Oct 29 (due Nov 1). Alpine Linux nearly lost its server because GitLab upgrades alone did not patch its Ruby. Versions, Ruby fixes and hunt steps.
Attackers can reboot Cisco firewalls through the VPN login page with one request. Upgrade before Sunday’s deadline

Attackers can reboot Cisco firewalls through the VPN login page with one request. Upgrade before Sunday’s deadline

Cisco ASA and Secure FTD CVE-2026-76418 lets an unauthenticated attacker reload a firewall through the SSL VPN login. Exploited, CISA KEV due Nov 1. Fixed releases and checks.
Thursday’s brief: PHP2Shell attackers root firewalls with a Linux bug, then WordPress 7.1.4, Jenkins and Oracle E-Business Suite

Thursday’s brief: PHP2Shell attackers root firewalls with a Linux bug, then WordPress 7.1.4, Jenkins and Oracle E-Business Suite

Linux Fragnesia CVE-2026-46300 on CISA KEV after a PHP2Shell firewall campaign, WordPress 7.1.4 security fixes, Jenkins 2.588 and Oracle EBS CVE-2026-101767 exploit attempts.
The Oracle E-Business Suite bug we flagged now has attackers testing it. Patch or close the servlet today

The Oracle E-Business Suite bug we flagged now has attackers testing it. Patch or close the servlet today

Defused saw exploit attempts on Oracle E-Business Suite CVE-2026-101767 on Oct 27. Apply the October 2026 CPU or remove /OA_HTML/AppsTCFServer from the URL firewall allowlist.
Jenkins users with basic access could run code on your build server. Upgrade to 2.588 or LTS 2.580.2

Jenkins users with basic access could run code on your build server. Upgrade to 2.588 or LTS 2.580.2

Jenkins Security Advisory 2026-10-28 fixes 15 core flaws, including XStream RCE CVE-2026-117612 and a setup wizard admin race CVE-2026-117618. Upgrade to 2.588 or LTS 2.580.2.
WordPress 7.1.4 fixes 22 security flaws, most open to anyone with a writer account. Check every site’s version

WordPress 7.1.4 fixes 22 security flaws, most open to anyone with a writer account. Check every site’s version

WordPress 7.1.4 (Oct 28, 2026) fixes 22 vulnerabilities, including an upgrade-window RCE and stored XSS in the Interactivity API and core blocks. Backports 7.0.8 and 6.9.11.
Attackers turned PHP2Shell break-ins into root on 24 firewalls with an old Linux bug. Boot a fixed kernel by Saturday

Attackers turned PHP2Shell break-ins into root on 24 firewalls with an old Linux bug. Boot a fixed kernel by Saturday

CISA added Linux kernel Fragnesia CVE-2026-46300 to KEV on Oct 28, due Oct 31, after Dream showed it chained with PHP2Shell to root 24 firewalls. Fixed kernels, memory checks and hunting steps.
Wednesday’s brief: Magento stores hit through the shopping cart, then Apple updates, Microsoft Authenticator and Brotli exploits

Wednesday’s brief: Magento stores hit through the shopping cart, then Apple updates, Microsoft Authenticator and Brotli exploits

Magento PolyShell CVE-2026-48356 and Brotli CVE-2026-111497 added to CISA KEV, Apple 27.2 and iOS 18.7.11 updates, and a Microsoft Authenticator Android token flaw, with first steps.