Skip to main content

WordPress Core Fix for CVE-2026-119977 Can Itself Briefly Expose Sites During Installation

Scope: WordPress Core, versions 4.7 through 7.1.3, including sites in the process of apply

CryptoPayment Gateway WordPress Plugin Has No Fix for Maximum Severity Flaw Exposing Wallet Credentials (CVE-2026-81648)

Scope: CryptoPayment Gateway WordPress plugin, versions 1.2.1 through 1.2.2 (no patched ve

“SSHole” OpenSSH Flaw Gains Root on Alpine Linux Honeypot Hours After Disclosure (CVE-2026-123158)

Scope: Linux systems running OpenSSH on the musl C library with PAM disabled, including Al

Years-Old Apple Pointer Authentication Bypass Back in Active Use for Espionage-Linked Malware Delivery (CVE-2024-27834)

Scope: Older Apple devices and browsers on builds predating the May 2024 security updates

Ruby on Rails Active Storage Flaw Lets Attackers Write Files and Leak Server Secrets via Image Uploads

Scope: Ruby on Rails, fixed in versions 8.1.4.1 and 8.0.5.2

WordPress Core Flaw Exploited During the Software Upgrade Process Itself (CVE-2026-119977)

Scope: WordPress Core, patched versions released late October 2026

BTCPay Server Hot Wallets Drained on Unpatched Self-Hosted Instances

Scope: BTCPay Server, versions 2.4.1 and earlier (fixed in 2.4.2, released August 7, 2026)

Subscribe to Advisories