WordPress, Drupal, e-commerce platforms, plugins and web servers: exploited flaws and how to check your sites.
Chrome 156 updates on 27 and 29 October fixed 73 security bugs, five Critical, most found by Anthropic with Claude. Update to 156.0.8078.79 or later.
Full core updates in WordPress 4.7 to 7.1.3 open a brief unauthenticated RCE window. Update to 7.1.4 or your branch’s fix and block wp-content/upgrade.
An exploited access bypass in Drupal Commerce Core can cost store owners money. Update to Commerce 3.3.13 or 8.x-2.41 and audit recent orders.
A public ChatGPT share link could run attacker JavaScript as chatgpt.com and read private chats. OpenAI fixed it on 26 Oct; MathLive users should update.
PolyShell lets attackers upload code to Magento and Adobe Commerce stores and is in CISA KEV. Install the -2026-jul builds, then check CMS blocks and pub/media.
Firefox 159 fixes 167 CVEs, with three sandbox escapes and a same-origin bypass. Update Firefox, ESR 153.6 or 115.44, and Thunderbird 159 or 153.6.
An ExifTool argument injection in Gotenberg before 8.31.0 gives unauthenticated command execution and is being exploited. Update and keep the API private.
Apple’s 26 October updates fix 163 CVEs in iOS 27.2, including WebKit code execution and a sandbox escape. Update iOS, macOS, Safari and older-device builds.
Microsoft re-fixed two October .NET flaws and a Linux tarball privilege bug. Install .NET 8.0.33, 9.0.22 or 10.0.14, then rebuild self-contained apps.
A new PHP session upload progress RCE needs an unusual setup and has no fix yet. Set session.upload_progress.enabled=0; Windows users install the -1 builds.
An unauthenticated command injection in Nextcloud’s Built-in CODE Server app is used to drop web shells. Update richdocumentscode to 26.4.303 or remove it.
Capcom says attackers reached CAPCOM ID data for 11,774,247 accounts on 19 Oct 2026 and hijacked 196 of them; 19 e-Capcom profiles were viewed. No card data.
Stolen UpdraftCentral keys let attackers install backdoor plugins on UpdraftPlus sites. Update to 1.26.13 or 2.26.13, delete keys, then hunt for the backdoor.
SoftBank detected an unauthorized access attempt on My SoftBank systems on 17 Oct 2026 and shut its customer websites for four days. No data leak announced.
Rank Math PRO 3.0.123 copies fetched 15-16 Oct 2026 held a self-restoring backdoor. Delete the plugin folder, clear three options, install 3.0.124.
Ahold Delhaize took most brands’ websites and apps offline in Europe and the US after malicious activity in its network on 12 Oct 2026. No data theft found yet.
CISA marked five bugs from 2015 to 2023 as exploited on 8 Oct 2026. Find old Struts 2, Strapi, ONLYOFFICE Docs, ProFTPD and BIND installs and upgrade them.
Attackers used one firm’s CPR access to pull names, addresses and CPR numbers of 8.8 million people in Sep 2026. A CPR number no longer proves identity.
Exploited bugs in AhsayCBS, SiteGuard Server Edition and Siemens Software Center joined KEV in October 2026. Fixed builds, workarounds and IOCs for each.
A Zammad session hijack (6.3 to 6.5) plus a root escalation in DEB/RPM packages breached DIVD. Move to Zammad 7.2.2 or later and check logs for leaked cookies.
A default authentication client in SAP Commerce Cloud’s Data Hub Adapter lets attackers run code without logging in. Deploy 2211.55 or 2211-jdk21.17 now.
Three exploited flaws in on-premises SharePoint 2016, 2019 and Subscription Edition chain to code execution. Install the July 2026 update, rotate machine keys.
A pre-auth flaw in PeopleTools 8.61 and 8.62 was used by ShinyHunters to steal data, mostly from universities. Apply Oracle’s fix and block /PSEMHUB/.
nginx-ui’s /mcp_message endpoint let anyone rewrite nginx configs with no login; it has been exploited. Upgrade nginx-ui and keep port 9000 off the internet.
A Ghost SQL injection (3.24.0 to 6.19.0) leaks Admin API keys and was used to inject ClickFix scripts. Update to 6.19.1, rotate keys, clean posts.
