On October 29, 2026, OpenSourceMalware reported that Claude Code extension build 2.1.313 reached the Cursor Marketplace carrying an SSH backdoor inside a package that identified itself as Anthropic's. Claude Code 2.1.313 risk sits on the laptop that edits the site: if that PC installed the build, the passwords for your site may already sit on a machine an outsider can reach.
CISA has added two more Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog. Together with an authentication bypass listed on October 13, they form a chain that gives an attacker root on the VPN appliance without a login. If your servers sit behind that gateway, the passwords it guards are what is really at stake.
WordPress 7.1.4, released October 28, 2026, is a WordPress core RCE update. It closes a flaw that lets someone with no login run code on a site while a full core upgrade is unpacking. Within a day, Wordfence had blocked 62,969 attempts to hit that window, so how you apply the patch matters almost as much as applying it.
WordPress 7.1.4, released October 28, 2026, is a WordPress core RCE update. It closes a flaw that lets someone with no login run code on a site while a full core upgrade is unpacking. Within a day, Wordfence had blocked 62,969 attempts to hit that window, so how you apply the patch matters almost as much as applying it.
CVE-2026-98432, a race condition in the Linux kernel's IPv4 TCP connection setup, is rated 9.8 by the kernel's CVE team, and Ubuntu and Red Hat had no fixed kernel as of October 30. For website hosting, the fix depends on whoever controls the server's kernel. A WordPress or Joomla update does not touch it.
Drupal says CVE-2026-118539, a highly critical access-bypass flaw in Drupal Commerce Core, is being actively exploited in the wild. Updating Drupal core leaves this module untouched. The advisory's version numbers also need a careful second read before you call your shop patched.
Drupal has confirmed active exploitation of CVE-2026-118539, a highly critical Drupal Commerce access bypass that lets requests reach store routes and data they should never touch. Updating the module closes the hole, but you also need to check whether anyone changed your orders, prices or checkout settings while it was open.
Attackers are chaining the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) with Fragnesia, a Linux kernel bug tracked as CVE-2026-46300, to go from one unauthenticated web request to root. Plan the PHP2Shell kernel patch together with the PHP update: a WordPress update closes neither hole, and a routine reboot can erase the evidence.
WordPress 7.1.4, released October 28, 2026, fixes a WordPress update race condition that lets an unauthenticated attacker run code on a site while a core upgrade is in progress, along with 21 other security fixes. Scanners began probing for that brief window nine minutes after Wordfence shipped a blocking rule, so check that your site actually installed the patched build.
WordPress 7.1.4, released October 28, 2026, fixes a WordPress update race condition that lets an unauthenticated attacker run code on a site while a core upgrade is in progress, along with 21 other security fixes. Scanners began probing for that brief window nine minutes after Wordfence shipped a blocking rule, so check that your site actually installed the patched build.