--- title: "Security digest: October 28, 2026" url: https://erroneo.us/security/2026-10-28/ description: "October 28, 2026 vulnerability digest: 4 briefs (WordPress 7.1.4: Unauthenticated Upgrade-Window…); 2 CISA KEV additions (Broadcom, Linux); 3 critical…" type: security-digest-day section: "Security Digest" date_published: 2026-10-28 date_modified: 2026-11-04 publisher: erroneo.us author: erroneo.us Security Desk license: All rights reserved. Quote with attribution and a link. --- # Security digest: October 28, 2026 4 editorial briefs, 2 known exploited (cisa kev) additions and 3 critical advisories. ## Take stock - Act now: WordPress 7.1.4: Unauthenticated Upgrade-Window RCE . Self-hosted WordPress sites that update core through the built-in updater or WP-CLI, especially those with background updates disabled or still on an old branch. - Act now: Fragnesia . Owners of Linux servers, container nodes, CI runners and shared hosts where web apps (especially PHP), tenants or untrusted jobs run as non-root users, plus anyone operating Linux-based appliances that serve web interfaces. - Act now: Drupal Commerce Core CVE-2026-118539: Exploited Bypass . Every Drupal site with the Commerce Core module (drupal/commerce) installed, on either the 3.x or 8.x-2.x line. - Check exposure: Cisco ASA/FTD CVE-2026-76418: Exploited VPN Crash Bug . Teams whose Cisco ASA or FTD terminates SSL remote access VPN and has secondary-authentication-server-group set on a reachable tunnel group, including DefaultWEBVPNGroup. - Do you run any of these? Linux Kernel, Broadcom VMware ESX. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-10-31. - crates.io (Rust): 2 critical advisories ( wasmtime , zip ). Check with cargo audit . - PyPI: 1 critical advisory ( electrum ). Check with pip-audit (or: pip show ) . - None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully. ## Editorial briefs - **Act now** [WordPress 7.1.4: Unauthenticated Upgrade-Window RCE](https://erroneo.us/security/briefs/wordpress-7-1-4-upgrade-window-rce-cve-2026-119977/index.md): CISA now lists this as exploited and Wordfence is blocking thousands of attempts a day; the window is narrow, but confirm today that every site is on 7.1.4 or its branch backport and block PHP under wp-content/upgrade/. - **Act now** [Fragnesia: Exploited Linux Kernel Root Bug CVE-2026-46300](https://erroneo.us/security/briefs/fragnesia-linux-kernel-lpe-cve-2026-46300/index.md): Any Linux host that runs untrusted or internet-facing code should be on a kernel with the May 2026 fix today; attackers are now using this public, race-free root exploit right after a web foothold. - **Act now** [Drupal Commerce Core CVE-2026-118539: Exploited Bypass](https://erroneo.us/security/briefs/drupal-commerce-core-access-bypass-cve-2026-118539/index.md): Drupal says this access bypass is being exploited against live stores and can cost merchants money, so any site running Commerce Core should upgrade today and then audit recent orders. - **Check exposure** [Cisco ASA/FTD CVE-2026-76418: Exploited VPN Crash Bug](https://erroneo.us/security/briefs/cisco-asa-ftd-ssl-vpn-secondary-auth-dos-cve-2026-76418/index.md): Only ASA and FTD headends that offer SSL remote access VPN with secondary authentication can be crashed, but that is being done in the wild, so those devices should be upgraded this week. ## Known exploited (CISA KEV) - [CVE-2026-46300](https://erroneo.us/security/cve/CVE-2026-46300/index.md) Linux Kernel: Linux Kernel Missing Initialization of a Variable Vulnerability (CISA due 2026-10-31) - [CVE-2026-41709](https://erroneo.us/security/cve/CVE-2026-41709/index.md) Broadcom VMware ESX: Broadcom VMWare ESX Insufficient Logging Vulnerability (CISA due 2026-11-11) ## Critical advisories - [CVE-2026-115893](https://erroneo.us/security/cve/CVE-2026-115893/index.md) Wasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction — crates.io (Rust) wasmtime < 36.0.19 → 36.0.19; crates.io (Rust) wasmtime >= 37.0.0, < 48.0.7 → 48.0.7; crates.io (Rust) wasmtime >= 49.0.0, < 49.0.4 → 49.0.4 - [CVE-2026-115905](https://erroneo.us/security/cve/CVE-2026-115905/index.md) zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE — crates.io (Rust) zip <= 9.0.4 → 9.0.5 - [CVE-2026-117601](https://erroneo.us/security/cve/CVE-2026-117601/index.md) Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it — PyPI electrum < 4.8.3 → 4.8.3 --- Source page: https://erroneo.us/security/2026-10-28/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt