Mon, 9 November 2026Cybersecurity news & threat intel
CriticalVulnerabilities

CISA adds WordPress Core race condition to exploited list

CVE-2026-119977, a time-of-check/time-of-use race in WordPress Core, is now on the KEV catalog based on evidence of active exploitation.

CVE-2026-119977WordPressKEV
Updated 9 Nov 2026

CVE-2026-119977, a time-of-check/time-of-use race in WordPress Core, is now on the KEV catalog based on evidence of active exploitation.

What to do

Treat this as urgent. Check whether you run the affected product, apply the vendor fix, and review logs for signs of compromise from before the patch.

Original reporting: CISA

Original reporting: CISA

Discussion

0 comments

Sign in to join the discussion.

Get the Weekly Wire

The week's exploited vulnerabilities and breaches, in one email.

More Vulnerabilities

CriticalVulnerabilities

Attackers hit OpenSSH 'SSHole' flaw within hours of disclosure

A newly disclosed OpenSSH bug can let attackers sign in to accounts that have no password set. Researchers saw exploitation attempts almost immediately, and one honeypot was taken to root. Audit for passwordless accounts and update OpenSSH as soon as your distribution ships the fix.

OpenSSHLinuxRoot access
The Hacker News