Security news 45/2026

WordPress Core

WordPress core versions 4.7 through 7.1.3 use predictable, web-accessible temporary paths during a full update, allowing an unauthenticated attacker to execute their own code on the server at the moment of the update. The flaw is actively exploited, and the patch itself is installed by the old, vulnerable code, so a site may be exposed one last time precisely during the update.

What to do: Update WordPress on all hosted sites and restrict web access to the temporary directories used by the update while it runs.

SonicWall SonicOS SSL-VPN

An authentication enforcement flaw allows a user with valid credentials for a different login method to bypass SAML and thus also MFA enforced via SAML. An attacker gains VPN access without a second factor; the flaw is exploited in attacks and SonicWall fixed it along with six other flaws.

What to do: Install the latest SonicOS updates and check SSL-VPN logs for suspicious logins via alternative authentication methods.

Apple Safari, iOS/iPadOS, macOS, tvOS, watchOS; WebKitGTK/WPE WebKit

An older flaw that allows an attacker with arbitrary memory read and write capability to bypass Pointer Authentication. It is now being exploited to spread data-stealing malware.

What to do: Verify that corporate Apple devices run up-to-date OS and Safari versions, and update WebKitGTK/WPE WebKit on Linux workstations.

Attacks on OpenSSH SSHole flaw began within hours of disclosure

CVE-2026-123158 in OpenSSH on musl-based Linux without PAM (typically Alpine) allows logging into accounts without a password, e.g. SSH key-only accounts, by entering a password 257–1024 bytes long. Attackers began probing it within hours and gained root on a honeypot. OpenSSH released version 10.6p2 and Alpine shipped patched packages – update all Alpine containers and servers.

Ivanti patches two more Connect Secure zero-days exploited since October

Ivanti released fixes for two flaws in the Connect Secure VPN gateway (CVE-2026-111357, CVE-2026-118527) that attackers have been chaining since at least October 1. Anyone running Connect Secure should update immediately and check the gateway for signs of compromise over the past weeks.

Attackers install backdoors on Siemens SIMATIC IoT2050

Critical flaw CVE-2026-58115 (CVSS 10.0) in SIMATIC IoT2050 Advanced devices allows an unauthenticated attacker to execute code; it is actively exploited to install backdoors for remote commands. It affects companies with industrial gateways – do not expose the devices to the internet and update per the vendor's guidance.

Attack via service provider enabled fraudulent transactions worth $133M

French bank Crédit Mutuel Arkéa faced an attack that, via a service provider, enabled fraudulent transactions of up to 133 million dollars, and had to shut down part of its systems. The case is a reminder of the need to monitor external suppliers' access to your own infrastructure.

Third-party cloud breach hits 7.7 million Iris Ohyama customers

Japanese manufacturer Iris Ohyama announced that personal data of about 7.7 million people may have leaked after unauthorized access to an external supplier's cloud service. It is another case where the weak point is a supplier's service rather than the company's own systems.

Ransomware knocks out Queens library Wi-Fi, checkouts and website

The Queens Public Library in New York was hit by ransomware that knocked out Wi-Fi, the checkout system and the website. No group has claimed the attack yet.

NÚKIB warns of attacks on remote management of refrigeration equipment

NÚKIB summarizes information and recommendations regarding active attacks on remote management systems for commercial and industrial refrigeration equipment in several European countries. It has not yet recorded a case in Czechia but strongly recommends preventive measures to all operators. If your network hosts customers' refrigeration control units, verify they are not reachable from the internet.

CSIRT.CZ: supermarket cooling attacks enabled by ignoring vendor guidance

Following attacks on the refrigeration systems of hundreds of French supermarkets, CSIRT.CZ points out that the attacks were made possible by failure to follow vendor guidance and that thousands of devices remain at risk. Administrators should check the configuration of these devices against the vendor's recommendations.

FreeSWITCH

In versions before 1.11.3, a peer can execute FreeSWITCH API commands, including operating system commands with daemon privileges, via a SIP MESSAGE; any authenticated profile account suffices and inbound chat is enabled in default profiles. The attacker gains configuration and credentials, control over calls and code execution – exploitation has already been observed.

What to do: Update FreeSWITCH to 1.11.3 and until then restrict access to SIP profiles to trusted peers only.

ManageEngine Key Manager Plus

In versions before 7151, an authenticated user with certificate deployment rights can inject commands when configuring a deployment target and execute them on the server. The flaw has a high EPSS, meaning an elevated likelihood of exploitation.

What to do: Update Key Manager Plus to version 7151 or later and review who has certificate deployment permissions.

Edimax BR-6208AC

The router in version 1.32 contains remotely exploitable command injection via /goform/mp without authentication, allowing an attacker to take over the device. An exploit is public and the vendor did not respond to the disclosure.

What to do: Determine whether you or your customers run these routers, block access to their management from the internet and consider replacing them.

Linksys E5350

Firmware 1.0.00.037 allows remote command injection via the ping_ip/traceroute_ip parameters in /wizard/apply.cgi; the related flaw CVE-2026-121933 allows changing wizard settings without authentication. Exploits are public and the vendor has not responded; similar flaws also affect the unsupported WRT54GL.

What to do: Restrict management access to these routers to the internal network only and replace unsupported units.

ELEX WordPress HelpDesk & Customer Ticketing System (plugin)

In versions up to 3.3.8, an unauthenticated attacker can delete arbitrary files on the server using a two-step procedure. Deleting e.g. wp-config.php can lead to code execution and site takeover.

What to do: Update the plugin per the vendor's guidance, or deactivate it until a fix is released.

s2Member (WordPress plugin)

In versions up to 260927, insufficient sanitization of the item_name parameter allows PHP code to be injected into an email template. An authenticated attacker with custom level or higher can thus execute code on the server.

What to do: Update the plugin per the vendor's guidance and identify sites on your hosting that use it.

Control Web Panel (CWP)

In versions before webpanel_version 1.16, commands can be injected into shell_exec in the protected_directory module of the user panel. A logged-in hosting user can thus execute arbitrary commands in the user panel context; a similar flaw, CVE-2026-73697 in the phpini_editor module, additionally allows writing files to arbitrary paths.

What to do: Update CWP to version 1.16 or later.

Usermin

In versions up to 2.570, an IMAP folder name containing shell metacharacters can be used to execute commands under the user's system account, bypassing the webmail-only restriction. It is enough to create the folder with an external IMAP client and then delete it in Usermin.

What to do: Watch for a vendor fix and until then restrict Usermin access to users who need it.

Nagios XI

In versions before 2026R2, a logged-in administrator can execute commands as the web server user via a crafted name of an uploaded MIB file. The risk increases if an administrator account is compromised.

What to do: Update Nagios XI to 2026R2 and restrict access to the monitoring administration.

Irontec sngrep

In versions up to 1.9.0, a crafted SIP packet over UDP or TCP, or a pcap file, can crash sngrep or leak part of stack memory into displayed SIP fields. This affects those who use sngrep to debug VoIP traffic.

What to do: Update sngrep per the vendor's guidance and do not run it permanently on interfaces exposed to untrusted SIP traffic.