Act now:WordPress 7.1.4: Unauthenticated Upgrade-Window RCE. Self-hosted WordPress sites that update core through the built-in updater or WP-CLI, especially those with background updates disabled or still on an old branch.
Act now:Fragnesia. Owners of Linux servers, container nodes, CI runners and shared hosts where web apps (especially PHP), tenants or untrusted jobs run as non-root users, plus anyone operating Linux-based appliances that serve web interfaces.
Check exposure:Cisco ASA/FTD CVE-2026-76418: Exploited VPN Crash Bug. Teams whose Cisco ASA or FTD terminates SSL remote access VPN and has secondary-authentication-server-group set on a reachable tunnel group, including DefaultWEBVPNGroup.
Do you run any of these? Linux Kernel, Broadcom VMware ESX. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-31.
CISA now lists this as exploited and Wordfence is blocking thousands of attempts a day; the window is narrow, but confirm today that every site is on 7.1.4 or its branch backport and block PHP under wp-content/upgrade/.
Must act: Self-hosted WordPress sites that update core through the built-in updater or WP-CLI, especially those with background updates disabled or still on an old branch.
Can relax: Sites already on 7.1.4 or a fixed backport, sites on hosts that confirm platform mitigations, and installs deployed by Composer, Git or images that never run the in-app core updater (they still want the other 21 fixes).
Check the running version on every site (wp core version) and confirm it is 7.1.4 or the fixed release for its branch; do not assume background updates finished.
Deny execution of PHP under wp-content/upgrade/ at the web server, ideally before running any further core update.
Update sites with background updates disabled now: wp core update, then wp core update-db.
Any Linux host that runs untrusted or internet-facing code should be on a kernel with the May 2026 fix today; attackers are now using this public, race-free root exploit right after a web foothold.
Must act: Owners of Linux servers, container nodes, CI runners and shared hosts where web apps (especially PHP), tenants or untrusted jobs run as non-root users, plus anyone operating Linux-based appliances that serve web interfaces.
Can relax: Hosts already booted into a distribution kernel that includes the fix, Ubuntu 20.04 and older on standard kernels, and Amazon Linux, which Tenable says does not ship the espintcp module.
Run uname -r on every Linux host and compare it with your distribution's fixed kernel for CVE-2026-46300.
Install the fixed kernel and reboot into it, starting with internet-facing web servers, shared hosts, CI runners and container nodes.
Before rebooting any host that was exposed to PHP2Shell or other web exploits, run the detection checks first; a reboot erases the in-memory tampering.
Drupal says this access bypass is being exploited against live stores and can cost merchants money, so any site running Commerce Core should upgrade today and then audit recent orders.
Must act: Every Drupal site with the Commerce Core module (drupal/commerce) installed, on either the 3.x or 8.x-2.x line.
Can relax: Drupal sites without Commerce Core, and stores on other platforms; Drupal core itself is not affected by this advisory.
Check the installed version with composer show drupal/commerce.
Upgrade: composer require 'drupal/commerce:^3.3.13' (or 'drupal/commerce:^2.41' on 8.x-2.x), then drush updb and drush cr.
Audit orders placed or changed since at least early October for inconsistencies: totals, prices, adjustments, payment state and ownership.
Only ASA and FTD headends that offer SSL remote access VPN with secondary authentication can be crashed, but that is being done in the wild, so those devices should be upgraded this week.
Must act: Teams whose Cisco ASA or FTD terminates SSL remote access VPN and has secondary-authentication-server-group set on a reachable tunnel group, including DefaultWEBVPNGroup.
Can relax: Firewalls without SSL VPN enabled, VPN headends that use only a single authentication server, and Cisco's cloud-delivered firewall, cdFMC, Secure Access and Secure FMC, which Cisco lists as not vulnerable.
On each ASA and FTD, check for webvpn with an enabled interface and for secondary-authentication-server-group on any reachable tunnel group.
Upgrade exposed devices to the first fixed release for their train, internet-facing VPN headends first.
If you cannot upgrade yet and DefaultWEBVPNGroup has no secondary authentication, disable the tunnel group list with no tunnel-group-list enable.