Plone hotfix 20261110 addresses remote code execution
Supported Plone 6.0, 6.1 and 6.2 are affected; the forwarded notice is cut off after older versions.
Stories per day · 30 days
6 RSS
Relatedrce8drupal4field-ui3wordpress3craft-cms2cve-2026-1080972openssl2sa-core2active-exploitation1aes-gcm-siv1authentication1c21camera-management1canada1commerce-mollie1cve-2026-1080991dll-sideloading1entity-list1
45 stories, newest first · one card per story
Stories tagged #cms
OpenSSL merges five low-severity fixes ahead of December releases
Fixes are in the public GitHub repository; packaged releases are scheduled for December 1, 2026.
WordPress 7.1.4 fixes 22 flaws, including RCE under attack
Wordfence says unauthenticated RCE in WordPress 4.7 through 7.1.3 drew more than 18,500 exploit requests in 21 hours; successful compromises are not confirmed.
WordPress 7.1.4 patches 22 flaws, including an upgrade-window RCE
Supported branches should install 7.1.4 or the matching legacy release; the advisory assigns no CVE IDs or scores.
Compromised camera software used to deploy malware, Huntress says
In September and October cases, attackers dropped rs.win32.exe, sideloaded DLLs with WpcMon.exe, and beaconed to a C2 host.
1
Craft CMS and Commerce-mollie need updates, Cyber Centre says
CMS before 4.18.9 and 5.11.2, and Commerce-mollie before 4.4.3, are affected as of October 23.
PHP urges workaround for unpatched RCE CVE-2026-115560
The bug needs a rare runtime switch of the session serialize handler and will not be fixed until the next release.
OpenSSL CMS integrity-check flaw lets attackers tamper with messages
ZDI rates CVE-2026-34182 at CVSS 3.1 and says the attacker must already be able to modify the messages.
Craft CMS before 4.18.8 and 5.11.0 has authenticated RCE flaws
Canada's Cyber Centre lists Twig sandbox bypasses and admin remote code execution and urges administrators to apply updates.
HTTP 401 means the server rejected unproven credentials
Sucuri covers WordPress, server, and API causes, and when a sudden wave of 401s can indicate compromise.
Drupal patches critical RCEs CVE-2026-108097 and CVE-2026-108099
The captured page gives no affected versions, fixed releases, or statement on exploitation.
Drupal warns of critical Field UI RCE in core (CVE-2026-108097)
Core alone is not directly exploitable, but at least one contributed-module path needs no login.
Drupal patches critical RCE flaws, warns exploits may emerge soon
Drupal patched two critical remote code execution flaws and warned exploits could appear within hours or days.
Drupal core - Critical - Remote code execution - SA-CORE-2026-014
Drupal warns of critical Field UI remote code execution, CVE-2026-108097, including an unauthenticated contributed-module path.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026)
Wordfence’s weekly report lists new WordPress vulnerabilities, but this excerpt names none.
Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks
WordPress 7.1.3 patches stored XSS, SQL injection, and unauthenticated disclosure of private-post comments.
Cloudflare’s EmDash 1.0 makes sandboxed plugins ask for access first
Cloudflare released EmDash 1.0, an open-source CMS that sandboxes plugins until administrators approve access.
1
[20260905] - Core - Arbitrary directory deletion via cache purge action
Joomla fixed high-severity CVE-2026-90915, a cache-purge path traversal that can delete directories.
[20260914] - Core - MFA Authentication Bypass through rememberme cookies
Joomla remember-me cookies can bypass MFA on CMS 4.0.0–6.1.3; fixed in 5.4.9 and 6.1.4.
[20260913] - Core - Improper ACL checks for varous webservice edit tasks
Joomla webservice edit tasks skip ACL checks, allowing unauthorized edits; patched in 5.4.9 and 6.1.4.
Trump admin using AI to deny medical care for seniors in disastrous experiment
CMS's WISeR pilot uses AI to prior-authorize Medicare care, producing long delays and denial rates above 50 percent.
2
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)
Wordfence published its weekly WordPress vulnerability report for September 14–20, 2026.
CVE-2026-87902 in WordPress Enables Conditional RCE
WordPress patches CVE-2026-87902, an unauthenticated path traversal that can enable conditional remote code execution.
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
WordPress patched a critical unauthenticated path traversal that can enable PHP inclusion and RCE.