Act now:WordPress Core: Page-Template File Inclusion to RCE. Anyone running self-managed WordPress 4.7 through 7.1.1, especially with a theme that has a top-level page-* directory or PHP with register_argc_argv enabled (official php Docker images, cPanel on PHP below 8.5).
Patch this week:Linux AF_UNIX CVE-2026-80521: Public Container Escape. Operators of CI runners, multi-tenant Kubernetes clusters, code-execution sandboxes and shared container hosts on Linux 6.10 or later, or on 6.1/6.6 kernels that carry the new AF_UNIX garbage collector.
Check exposure:Graphalgo. Go developers and infrastructure teams who added gocommunity.io/orderedbtree, gogets.dev/btreex, or the kreuzwenker/docker or gocommunity-io/dockerd Terraform providers, including through a coding task or sample repository someone sent them.
Do you run any of these? F5 BIG-IP APM, Arista VeloCloud Orchestrator, Check Point Multiple Products. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-09-25.
PyPI: 3 critical advisories (homeassistant, mcp-atlassian, lightrag-hku). Check with pip-audit (or: pip show <package>).
Go: 1 critical advisory (github.com/openbao/openbao). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Every WordPress branch back to 4.7 was affected, no login is needed, public scanning tooling exists and attackers are already writing files through pearcmd.php, so confirm you are on a fixed release today.
Must act: Anyone running self-managed WordPress 4.7 through 7.1.1, especially with a theme that has a top-level page-* directory or PHP with register_argc_argv enabled (official php Docker images, cPanel on PHP below 8.5).
Can relax: Sites already on 7.1.2 or the patched release for their branch (auto-updates usually handled this), and managed hosts that have confirmed the update in writing.
Confirm each site reports 7.1.2 or the patched release for its branch (wp core version).
Update now from Dashboard > Updates or with wp core update --minor; do not wait for the next maintenance window.
If you cannot update immediately, block requests whose pagename parameter contains encoded traversal (%2e%2e, %252e%252e).
If you run untrusted or third-party code in containers on a 6.10+ kernel, install fixed kernels as they ship and move that code behind stronger isolation now; a public exploit turns an unprivileged container process into a host compromise.
Must act: Operators of CI runners, multi-tenant Kubernetes clusters, code-execution sandboxes and shared container hosts on Linux 6.10 or later, or on 6.1/6.6 kernels that carry the new AF_UNIX garbage collector.
Can relax: Hosts that only run code you already trust can patch on a normal cycle; kernels without the new garbage collector (for example Debian 11, RHEL 6-9 and Ubuntu 22.04's default 5.15 kernel) need nothing.
List container hosts and node kernels (uname -r on each node, or kubectl get nodes -o wide) and flag any that run untrusted code.
Install your distribution's fixed kernel as soon as it ships and reboot or livepatch; on Debian 13 and 12 the fixes are already available.
Until Ubuntu 24.04/26.04 fixes land, move untrusted workloads (CI jobs, code runners, tenant pods) to gVisor, Kata Containers or Firecracker, or to a node pool on an unaffected kernel.
Grep your go.mod, go.sum and Terraform files for four names; if none match you are done, and if one does, treat the machine as compromised.
Must act: Go developers and infrastructure teams who added gocommunity.io/orderedbtree, gogets.dev/btreex, or the kreuzwenker/docker or gocommunity-io/dockerd Terraform providers, including through a coding task or sample repository someone sent them.
Can relax: Teams whose dependency files contain none of the four names, and Terraform users whose lock files reference the genuine kreuzwerker/docker provider.
Search Go projects: grep -rnE 'gogets\.dev/btreex|gocommunity\.io/orderedbtree' --include=go.mod --include=go.sum .