Cowrie honeypots logged the first all-A SSH password strings on November 5, right after long brute-force attempts spiked from 23 on the 1st to 232 on the 5th.
Early attempts were mostly broken scripts that injected shell metacharacters instead of real passwords. Once the scanners switched to clean strings, the same sessions delivered a chained downloader that tried wget, busybox wget, then curl before chmod and exec.
Leading sources were 213.86.169.133 (COLT), 152.233.50.185 (CDNEXT), and 92.255.57.7 (SERVER-MANIA). They spent four days mapping the surface before any working payload appeared.
Watch for the sudden jump from random long passwords to uniform all-A strings followed by identical /tmp dropper chains; that sequence has been the reliable early signal on these sensors.
Early attempts were mostly broken scripts that injected shell metacharacters instead of real passwords. Once the scanners switched to clean strings, the same sessions delivered a chained downloader that tried wget, busybox wget, then curl before chmod and exec.
Leading sources were 213.86.169.133 (COLT), 152.233.50.185 (CDNEXT), and 92.255.57.7 (SERVER-MANIA). They spent four days mapping the surface before any working payload appeared.
Watch for the sudden jump from random long passwords to uniform all-A strings followed by identical /tmp dropper chains; that sequence has been the reliable early signal on these sensors.
0
0
0
10
A predictable local-dev credential on the legacy internal-tools platform reached WorkOS production endpoints with zero rate limiting on the exposed APIs.
Access to the internal sales app started 25 October and was only spotted on 30 October.
Regular external testing of internet-facing systems began 3 November. The researcher confirmed all data was deleted and handed over matching request logs.
Rotate every long-lived dev credential the moment it can touch production, then enforce network segmentation.
Access to the internal sales app started 25 October and was only spotted on 30 October.
Regular external testing of internet-facing systems began 3 November. The researcher confirmed all data was deleted and handed over matching request logs.
Rotate every long-lived dev credential the moment it can touch production, then enforce network segmentation.
0
0
0
8
A 257-byte password lets anyone in on Alpine Linux openssh-server.
Releases 3.16 through 3.24 and edge are affected. One account must have * in the password field. Another needs a $5$ or $6$ hash. PasswordAuthentication yes and UsePAM no complete the setup.
Without PAM, sshd calls crypt() on the supplied password. Musl's crypt() returns * for any key over 256 bytes. It borrows the salt from the second hash. The match succeeds against the first account's * field.
Tiny-cloud images 3.18.11 through 3.24.3 ship the alpine user with * and passwordless doas. Fixed packages are now in edge 10.6_p2-r0, 3.24 10.3_p1-r2, and down to 3.16 9.0_p1-r6.
The bypass lives entirely in the interaction between musl crypt() and sshd's fallback path when PAM is absent.
Releases 3.16 through 3.24 and edge are affected. One account must have * in the password field. Another needs a $5$ or $6$ hash. PasswordAuthentication yes and UsePAM no complete the setup.
Without PAM, sshd calls crypt() on the supplied password. Musl's crypt() returns * for any key over 256 bytes. It borrows the salt from the second hash. The match succeeds against the first account's * field.
Tiny-cloud images 3.18.11 through 3.24.3 ship the alpine user with * and passwordless doas. Fixed packages are now in edge 10.6_p2-r0, 3.24 10.3_p1-r2, and down to 3.16 9.0_p1-r6.
The bypass lives entirely in the interaction between musl crypt() and sshd's fallback path when PAM is absent.
0
0
0
22
Attackers holding valid credentials for any alternate auth method can bypass SAML-enforced MFA on SonicWall SSL-VPN when that mode is enabled.
SonicOS Gen7 releases 7.3.3-7015 and earlier, plus Gen8 releases 8.2.2-8015 and earlier, are affected. Fixed builds are 7.3.4-7013 and 8.2.3-8015. No workarounds exist. CISA added the flaw to the KEV catalog with a November 20, 2026 deadline for federal agencies.
SAML checks never gated the alternate credential path. An attacker who authenticates via the non-SAML method reaches the VPN session without ever hitting the MFA requirement.
The missing gate is what let the bypass work in the wild.
SonicOS Gen7 releases 7.3.3-7015 and earlier, plus Gen8 releases 8.2.2-8015 and earlier, are affected. Fixed builds are 7.3.4-7013 and 8.2.3-8015. No workarounds exist. CISA added the flaw to the KEV catalog with a November 20, 2026 deadline for federal agencies.
SAML checks never gated the alternate credential path. An attacker who authenticates via the non-SAML method reaches the VPN session without ever hitting the MFA requirement.
The missing gate is what let the bypass work in the wild.
0
0
0
19
Backdoored cwpsrv binary slips into Control Web Panel via a tainted updater script.
The cwpsrv_update.sh installer, MD5 e505d4ffa21cf494a5dc2d7c8f4f1236, first surfaced June 29 and must run as root to replace the binary on versions 1.15.10 and 1.24.0. No CVE has been published.
The malicious cwpsrv 1.15.10 binary, MD5 965aea67fb40de1bab5169ada993349f, hit VirusTotal September 30 from a Brazilian submitter.
Activation follows a strict sequence: the implant inspects incoming HTTP requests for a valid timestamp and signature in X-Ngx-Integrity headers, then forwards commands over the ngx_http_integrity_helper Unix socket for execution without touching standard logs. The original binary is restored immediately after.
Watch for the ngx_http_integrity_helper socket and unexpected X-Ngx-Integrity headers in traffic.
The cwpsrv_update.sh installer, MD5 e505d4ffa21cf494a5dc2d7c8f4f1236, first surfaced June 29 and must run as root to replace the binary on versions 1.15.10 and 1.24.0. No CVE has been published.
The malicious cwpsrv 1.15.10 binary, MD5 965aea67fb40de1bab5169ada993349f, hit VirusTotal September 30 from a Brazilian submitter.
Activation follows a strict sequence: the implant inspects incoming HTTP requests for a valid timestamp and signature in X-Ngx-Integrity headers, then forwards commands over the ngx_http_integrity_helper Unix socket for execution without touching standard logs. The original binary is restored immediately after.
Watch for the ngx_http_integrity_helper socket and unexpected X-Ngx-Integrity headers in traffic.
0
0
0
26
A network packet can trigger an out-of-bounds read in Microsoft Paint and hand an attacker remote code execution with no authentication or user interaction required.
The flaw sits in a per-user Store app that may also be provisioned on the device. Microsoft published the advisory on 13 October with CVSS 8.1 and no known exploitation at the time. The issue is still absent from CISA KEV.
The authoritative fixed build is 11.2609.401.0, delivered only through the Microsoft Store. The advisory originally listed 11.2605.91.0 as the patched version before the number changed without a revision note; CVE and NVD entries still cite versions below 11.2605.91.0.
Enterprises that rely solely on Windows Update will miss this patch and must pull the Store update directly.
The flaw sits in a per-user Store app that may also be provisioned on the device. Microsoft published the advisory on 13 October with CVSS 8.1 and no known exploitation at the time. The issue is still absent from CISA KEV.
The authoritative fixed build is 11.2609.401.0, delivered only through the Microsoft Store. The advisory originally listed 11.2605.91.0 as the patched version before the number changed without a revision note; CVE and NVD entries still cite versions below 11.2605.91.0.
Enterprises that rely solely on Windows Update will miss this patch and must pull the Store update directly.
0
0
0
35
An unauthenticated POST to /register/step2 accepted a username, email and password on SourceHut instances that had registration disabled.
Attackers could fetch a valid CSRF token from /login and reuse it directly on the registration endpoint. A working SMTP server was still needed for the confirmation mail, yet this only delayed the account rather than blocking creation.
The bug was introduced during the 2021 Flask/Jinja to Go GraphQL migration and shipped in versions 0.56.11–0.88.9. It was disclosed 2026-11-02; CVE-2026-121728 was assigned the next day, affecting multiple instances.
The design mistake was accepting a login CSRF token on the registration path.
Attackers could fetch a valid CSRF token from /login and reuse it directly on the registration endpoint. A working SMTP server was still needed for the confirmation mail, yet this only delayed the account rather than blocking creation.
The bug was introduced during the 2021 Flask/Jinja to Go GraphQL migration and shipped in versions 0.56.11–0.88.9. It was disclosed 2026-11-02; CVE-2026-121728 was assigned the next day, affecting multiple instances.
The design mistake was accepting a login CSRF token on the registration path.
0
0
0
45
Zyxel GS1900 switches on 2.90 Patch 2 remain exploitable through an unauthenticated out-of-bounds write in the web management interface.
CVE-2026-7273 received a partial fix in Patch 2. The patch inserted a counter check after copying into a 140-parameter fixed buffer. An attacker supplies an oversized 140th parameter, overwrites the counter itself, then performs arbitrary writes that reach root command execution.
Binarly reported the bypass as CVE-2026-107441 on 2026-09-29. GreyNoise recorded exploitation of 996 GS1900 devices on 2026-08-17, before any public disclosure. 564 of those switches used factory-default credentials. Red Heron collected configuration files and hashed root passwords.
Patch 3, released 2026-10-23, addresses the flaw across the ten listed models from GS1900-8 through GS1900-48HPv2.
The first patch only validated what it had already copied.
CVE-2026-7273 received a partial fix in Patch 2. The patch inserted a counter check after copying into a 140-parameter fixed buffer. An attacker supplies an oversized 140th parameter, overwrites the counter itself, then performs arbitrary writes that reach root command execution.
Binarly reported the bypass as CVE-2026-107441 on 2026-09-29. GreyNoise recorded exploitation of 996 GS1900 devices on 2026-08-17, before any public disclosure. 564 of those switches used factory-default credentials. Red Heron collected configuration files and hashed root passwords.
Patch 3, released 2026-10-23, addresses the flaw across the ten listed models from GS1900-8 through GS1900-48HPv2.
The first patch only validated what it had already copied.
0
0
0
45
2946 servers pulled malicious cPGuard updates over a 12-hour window starting 02:06 UTC on November 2.
Stolen OpsShield CDN credentials let attackers serve bad packages for versions 5.88.12 through 5.88.19. The backdoor script ran with the update and shipped 32 files per server back to the licensing server.
It collected Linux password hashes, MariaDB and MySQL root configs, root shell history, authorized_keys, known_hosts, and the billing database.
The autoupdate path alone bypassed every other control because it trusted the CDN without further checks.
Upgrade to 5.88.25 or later to remove the staged files and backdoor. OpsShield is revoking the old support keys in a follow-up push.
Audit every autoupdate source and the keys it drops.
Stolen OpsShield CDN credentials let attackers serve bad packages for versions 5.88.12 through 5.88.19. The backdoor script ran with the update and shipped 32 files per server back to the licensing server.
It collected Linux password hashes, MariaDB and MySQL root configs, root shell history, authorized_keys, known_hosts, and the billing database.
The autoupdate path alone bypassed every other control because it trusted the CDN without further checks.
Upgrade to 5.88.25 or later to remove the staged files and backdoor. OpsShield is revoking the old support keys in a follow-up push.
Audit every autoupdate source and the keys it drops.
0
0
0
16
A SYN carrying Record Route or Timestamp options to any IPv4 TCP listener triggers the bug. The UAF lives in tcp_options handling: the option parser reuses a pointer into an skb that was already freed during early parsing of the IP options on the SYN path.
Remote code execution is possible on kernels from 4.4 onward. IPv6 listeners are not affected on the main receive path.
Red Hat and Ubuntu shipped fixes in early November. nftables rules that drop IPv4 TCP packets with ip hdrlength > 5 block the trigger before it reaches the stack.
Watch for inbound SYN packets with IP options in your flow logs.
Remote code execution is possible on kernels from 4.4 onward. IPv6 listeners are not affected on the main receive path.
Red Hat and Ubuntu shipped fixes in early November. nftables rules that drop IPv4 TCP packets with ip hdrlength > 5 block the trigger before it reaches the stack.
Watch for inbound SYN packets with IP options in your flow logs.
0
0
0
16
CVE-2025-8088 in WinRAR is being exploited through DLL sideloading to launch GIFTEDCROOK.
Gorbag, Russia-aligned and active since February 2025, is hitting Ukrainian law enforcement, justice entities, front-line administrations and the defense sector. It overlaps with UAC-0226 and SHADOW-EARTH-066 but uses its own tooling.
The group drops a legitimate WinRAR executable alongside a malicious DLL named WinRAR.dll in the same directory. CVE-2025-8088 triggers the sideload, GIFTEDCROOK executes, harvests cookies, history and credentials from Chrome, Edge and Firefox, then compresses and exfils the data over Telegram or a FastAPI C2 before self-deletion.
Spear-phishing .XLSM attachments with government lures deliver BeautyStealer. It collects the same browser data plus Opera, OpenVPN configs, Office files, archives, KeePass databases and RDP/VPN settings, then sends the archive the same way.
Monitor for WinRAR spawning unexpected child processes from RAR files in email attachments.
Gorbag, Russia-aligned and active since February 2025, is hitting Ukrainian law enforcement, justice entities, front-line administrations and the defense sector. It overlaps with UAC-0226 and SHADOW-EARTH-066 but uses its own tooling.
The group drops a legitimate WinRAR executable alongside a malicious DLL named WinRAR.dll in the same directory. CVE-2025-8088 triggers the sideload, GIFTEDCROOK executes, harvests cookies, history and credentials from Chrome, Edge and Firefox, then compresses and exfils the data over Telegram or a FastAPI C2 before self-deletion.
Spear-phishing .XLSM attachments with government lures deliver BeautyStealer. It collects the same browser data plus Opera, OpenVPN configs, Office files, archives, KeePass databases and RDP/VPN settings, then sends the archive the same way.
Monitor for WinRAR spawning unexpected child processes from RAR files in email attachments.
0
0
0
249
MECOOL KM9PRO Max boxes shipped with x.cpe and com.oemservice preinstalled in firmware, both running with system-level privileges from first boot. No CVE assigned.
com.abc.nexus loader appeared late 2024. The implant wrote directly into the /oem/ partition on Videostrong-based Android TV devices and restored itself after deletion.
C2 domains under anyevonline.com varied by Android version while mqtt.szbboys.com handled MQTT traffic. Residential proxy modules from Linkfog and NetNut plus ad fraud and secondary backdoors Moyu and Spirit loaded on demand.
Google seized more than a dozen C2 servers, cutting off the XCPE botnet and at least 10 million other compromised set-top boxes, karaoke machines and telehealth devices. Attribution rested on an open directory PDF authored by Videostrong R&D director Owen Cao, matching videostrong.cn and mqtt.anyevonline.com resolutions, and code signed with Videostrong email addresses. Google revoked the Android TV certification.
Inspect /oem/ for unsigned binaries or unexpected package names and compare firmware hashes against known good Videostrong builds.
com.abc.nexus loader appeared late 2024. The implant wrote directly into the /oem/ partition on Videostrong-based Android TV devices and restored itself after deletion.
C2 domains under anyevonline.com varied by Android version while mqtt.szbboys.com handled MQTT traffic. Residential proxy modules from Linkfog and NetNut plus ad fraud and secondary backdoors Moyu and Spirit loaded on demand.
Google seized more than a dozen C2 servers, cutting off the XCPE botnet and at least 10 million other compromised set-top boxes, karaoke machines and telehealth devices. Attribution rested on an open directory PDF authored by Videostrong R&D director Owen Cao, matching videostrong.cn and mqtt.anyevonline.com resolutions, and code signed with Videostrong email addresses. Google revoked the Android TV certification.
Inspect /oem/ for unsigned binaries or unexpected package names and compare firmware hashes against known good Videostrong builds.
1
0
0
107
A CVSS 9.8 kernel bug hands attackers remote code execution on Ubuntu 22.04, 24.04 and 26.04 LTS – and no patched linux-image packages have shipped.
Check exposure right now:
uname -r
apt-cache policy linux-image-$(uname -r) | grep Installed
No ETA. Run the checks and stay on alert.
Check exposure right now:
uname -r
apt-cache policy linux-image-$(uname -r) | grep Installed
No ETA. Run the checks and stay on alert.
0
0
1
42
An 8-byte WAP Push PDU — 01 06 88 80 80 80 00 BE — to port 2948 hits decodeWapPdu, returns -2147483648, and throws NegativeArraySizeException straight into com.android.phone. The process dies before any message reaches the inbox.
Same PDU during an active call, emergency or otherwise, takes the telephony stack down with it. Twenty rapid deliveries on Android 12 force a reboot every ninety seconds until recovery.
October 2026 patch for Android 14-17 wrapped the decoder and deleted the malicious row. Android 12 and 13 received no fix and no bulletin entry.
Remove the stored PDU with: adb shell content delete --uri content://sms/raw --where "_id=XX". The stack still parses unauthenticated WAP PDUs with zero length checks.
Same PDU during an active call, emergency or otherwise, takes the telephony stack down with it. Twenty rapid deliveries on Android 12 force a reboot every ninety seconds until recovery.
October 2026 patch for Android 14-17 wrapped the decoder and deleted the malicious row. Android 12 and 13 received no fix and no bulletin entry.
Remove the stored PDU with: adb shell content delete --uri content://sms/raw --where "_id=XX". The stack still parses unauthenticated WAP PDUs with zero length checks.
0
0
0
50
A malicious regex inside .gitlab-ci.yml was enough to trigger CVE-2026-97229.
The integer overflow occurred in the size calculation that Onigmo performs before compilation, turning a crafted pattern into out-of-bounds memory access and remote code execution.
GitLab released the fix in 19.3.5 on 12 October. Alpine was still on 19.3.4-r1 when eight workers crashed between 20–21 October; four showed partial success and the attackers pulled alpinelinux/gitlab:19.3.4-r1 the same day.
Bumping to 19.3.6-r0 left the vulnerable Ruby in place. On 27 October the project rebuilt from scratch with `docker build -t alpinelinux/gitlab:19.3.6 --build-arg RUBY_VERSION=3.3.13`, reset every credential, and published the new image.
Always rebuild the container against the patched Ruby instead of simply bumping the GitLab chart.
The integer overflow occurred in the size calculation that Onigmo performs before compilation, turning a crafted pattern into out-of-bounds memory access and remote code execution.
GitLab released the fix in 19.3.5 on 12 October. Alpine was still on 19.3.4-r1 when eight workers crashed between 20–21 October; four showed partial success and the attackers pulled alpinelinux/gitlab:19.3.4-r1 the same day.
Bumping to 19.3.6-r0 left the vulnerable Ruby in place. On 27 October the project rebuilt from scratch with `docker build -t alpinelinux/gitlab:19.3.6 --build-arg RUBY_VERSION=3.3.13`, reset every credential, and published the new image.
Always rebuild the container against the patched Ruby instead of simply bumping the GitLab chart.
0
0
1
90
Kaspersky flagged a CAB in C:\Windows\SoftwareDistribution\Download on a custom Windows 10 build used by government entities in Asia during the first half of 2026.
Extraction wrote files to the Install subfolder and dropped PatchMyPC-ScriptRunner.exe.config. That config registered a custom AppDomainManager so the process would load Microsoft.HostIntegration.Connectors.dll at startup. The DLL then read fabric.config to pull layered payloads from Resources.resx.
C2 traffic hit openaigpt4v[.]com after 20-40 minutes of jitter. Valid replies paused the loop for several minutes; failures triggered roughly 24-hour backoffs.
Check SoftwareDistribution\Download for unexpected CABs and review any .config that registers an AppDomainManager pointing outside Microsoft assemblies.
Extraction wrote files to the Install subfolder and dropped PatchMyPC-ScriptRunner.exe.config. That config registered a custom AppDomainManager so the process would load Microsoft.HostIntegration.Connectors.dll at startup. The DLL then read fabric.config to pull layered payloads from Resources.resx.
C2 traffic hit openaigpt4v[.]com after 20-40 minutes of jitter. Valid replies paused the loop for several minutes; failures triggered roughly 24-hour backoffs.
Check SoftwareDistribution\Download for unexpected CABs and review any .config that registers an AppDomainManager pointing outside Microsoft assemblies.
0
0
0
15
MPTCP listeners on IPv4 sockets trigger a use-after-free of inet_opt and ireq_opt during the TCP handshake.
The bug lives in net/ipv4/af_inet.c and tcp_ipv4.c. It affects kernels 4.4 through 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55 and 7.2.9. Eric Dumazet replaced the kfree with kfree_rcu in commit e3f33b0 on 1 October.
Check exposure with:
sysctl net.mptcp.enabled
ss -Mlnp
Go 1.24 and later creates MPTCP listeners by default when the sysctl is 1. IPv6 sockets are not affected. The window exists on any IPv4 TCP socket before application data.
Apply the upstream change or disable the listener:
```diff
- kfree(opt);
+ kfree_rcu(opt, rcu);
```
Set net.mptcp.enabled=0 to close the path until the host kernel is patched.
The bug lives in net/ipv4/af_inet.c and tcp_ipv4.c. It affects kernels 4.4 through 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55 and 7.2.9. Eric Dumazet replaced the kfree with kfree_rcu in commit e3f33b0 on 1 October.
Check exposure with:
sysctl net.mptcp.enabled
ss -Mlnp
Go 1.24 and later creates MPTCP listeners by default when the sysctl is 1. IPv6 sockets are not affected. The window exists on any IPv4 TCP socket before application data.
Apply the upstream change or disable the listener:
```diff
- kfree(opt);
+ kfree_rcu(opt, rcu);
```
Set net.mptcp.enabled=0 to close the path until the host kernel is patched.
0
0
0
26
VOLTA drops Identity_Report.txt on the victim then immediately builds a raw JSON POST to openrouter.ai/api/v1/chat/co… with no SDK or library calls. The system prompt forces the model into a forensic intelligence analyst role; the default model is anthropic/claude-opus-4.6 with fallbacks to moonshotai/kimi-k2 and google/gemini-2.5-flash at temperature 0.2. The reply is written straight to AI_Analysis.txt before both files are zipped as volta_dox.zip.
The same binary later produces volta_log.zip after first collection and volta_doxnet.zip after token harvesting. Every LLM call runs locally over the victim’s own network connection.
The sample is a build-time template carrying six encrypted config slots. The decryption key is derived by SHA-256 of two hardcoded constants stored inside the binary, a pattern consistent with a builder sold to multiple operators. No C2 domains or IPs are present.
Watch for processes reaching out to openrouter.ai, sudden creation of Identity_Report.txt or AI_Analysis.txt, and the three volta_*.zip packages.
The same binary later produces volta_log.zip after first collection and volta_doxnet.zip after token harvesting. Every LLM call runs locally over the victim’s own network connection.
The sample is a build-time template carrying six encrypted config slots. The decryption key is derived by SHA-256 of two hardcoded constants stored inside the binary, a pattern consistent with a builder sold to multiple operators. No C2 domains or IPs are present.
Watch for processes reaching out to openrouter.ai, sudden creation of Identity_Report.txt or AI_Analysis.txt, and the three volta_*.zip packages.
0
0
0
42
The malicious anthropic.claude-code 2.1.313 package on the Cursor Marketplace alone reached up to 5,000 users before anyone noticed.
A 66-line loader sat at the front of the main JavaScript bundle. It appended the attacker's key labeled svc-telemetry straight to ~/.ssh/authorized_keys, opened a reverse SSH tunnel to 134.209.82[.]225, and fired a beacon containing hostname, username, OS, Git email, and environment variable names to 134.209.82[.]225:8099/beacon. Persistence came via scheduled task on Windows, crontab on Linux, and LaunchAgent on macOS.
The campaign ran only from 02:27 to 13:35 PT on 2026-10-29 and used the exact same package name as the legitimate release, but only through the Cursor channel. Anthropic pushed clean version 2.1.314 to Open VSX and the Microsoft marketplace the next day.
Check ~/.ssh/authorized_keys, review recent crontab and LaunchAgents entries, and block 134.209.82[.]225 at the firewall.
A 66-line loader sat at the front of the main JavaScript bundle. It appended the attacker's key labeled svc-telemetry straight to ~/.ssh/authorized_keys, opened a reverse SSH tunnel to 134.209.82[.]225, and fired a beacon containing hostname, username, OS, Git email, and environment variable names to 134.209.82[.]225:8099/beacon. Persistence came via scheduled task on Windows, crontab on Linux, and LaunchAgent on macOS.
The campaign ran only from 02:27 to 13:35 PT on 2026-10-29 and used the exact same package name as the legitimate release, but only through the Cursor channel. Anthropic pushed clean version 2.1.314 to Open VSX and the Microsoft marketplace the next day.
Check ~/.ssh/authorized_keys, review recent crontab and LaunchAgents entries, and block 134.209.82[.]225 at the firewall.
0
0
0
16
GET /wp-content/upgrade/wordpress-4.7.0/wp-admin/setup-config.php
WordPress 4.7 through 7.1.3 dropped the full update package into a predictable wp-content/upgrade path. The installer files stayed world-readable until the process finished its own cleanup.
Attackers simply requested setup-config.php and the other staging files using the exact version string from the update request. No auth, no guessing.
Patches shipped in 7.1.4 with no CVE assigned.
Block wp-content/upgrade/ from web access before the next update window opens.
WordPress 4.7 through 7.1.3 dropped the full update package into a predictable wp-content/upgrade path. The installer files stayed world-readable until the process finished its own cleanup.
Attackers simply requested setup-config.php and the other staging files using the exact version string from the update request. No auth, no guessing.
Patches shipped in 7.1.4 with no CVE assigned.
Block wp-content/upgrade/ from web access before the next update window opens.
0
0
1
35