What you need to know today.

WordPress 6.8.x through 7.0.2 is affected by two critical vulnerabilities that allow for unauthenticated remote code execution and SQL injection. The first, CVE-2026-60137, stems from improper sanitization of the author__not_in parameter in WP_Query, enabling SQL injection. This is compounded by CVE-2026-63030, a REST API batch endpoint route confusion issue, which, when combined with the SQL injection vulnerability, allows attackers to bypass authentication and execute arbitrary SQL queries. Exploitation of these flaws, collectively dubbed "wp2shell," has been observed in the wild, with attackers using them to install webshells and gain full control of vulnerable sites. WordPress has released patches in versions 6.8.6, 6.9.5, and 7.0.2. As reported by BleepingComputer, CISA has added these vulnerabilities to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch them.

CISA has added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, including the critical WordPress flaws detailed above. The other additions are CVE-2026-56451, a critical flaw in Siemens Opcenter X that allows unauthenticated attackers to forge arbitrary JWTs and bypass authentication due to improper algorithm validation in the JWT header. Also added is CVE-2026-61884, a critical vulnerability in Tycon Systems TPDIN-Monitor-WEB2, where the web management interface fails to validate credentials server-side, allowing unauthenticated attackers to bypass login by submitting empty credentials. Finally, CVE-2026-10714, a high-severity vulnerability in Rockwell Automation FactoryTalk Services Platform (FTSP), allows attackers to bypass JWT signature validation during Okta Web Authentication due to similar issues with algorithm validation. These additions underscore the importance of timely patching for critical systems.

A significant number of vulnerabilities have been disclosed affecting Rockwell Automation products, with several rated as high severity. CVE-2026-10714, already noted as a KEV addition, impacts FactoryTalk Services Platform (FTSP) and allows JWT signature bypass. Additionally, CVE-2026-10573, a high-severity denial-of-service vulnerability in the 1734 POINT I/O module, can be triggered by crafted CIP messages, requiring a restart to recover. Two other high-severity denial-of-service vulnerabilities affect the 1718-AENTR and 1719-AENTR devices (CVE-2026-9140) due to improper handling of UDP unicast network storms, also requiring a power cycle. Furthermore, two high-severity remote code execution vulnerabilities exist in Studio 5000 Logix Designer: CVE-2026-9127 allows authenticated users to modify external tool paths due to incorrect authorization on configuration files, while CVE-2026-9128 exploits an unquoted search path in the External Tools configuration for code execution. CVE-2026-9108, a medium-severity path traversal vulnerability in Studio 5000 Logix Designer, allows manipulation of ACD project files. These disclosures highlight a broad range of risks within Rockwell's industrial control systems.

Several other vulnerabilities across various products warrant attention. CVE-2026-15370 is a stack buffer overflow in the libssh SFTP server related to longname construction. IAM Client SDK is affected by CVE-2025-40945, an untrusted search path vulnerability that could lead to privilege escalation for authenticated users. Tycon Systems TPDIN-Monitor-WEB2 also has a medium-severity vulnerability, CVE-2026-55985, where system credentials are stored in cleartext within the web management interface, accessible to authenticated users. The Linux kernel has seen several fixes, including CVE-2026-64187 (xfs recovery issue), CVE-2026-64188 (net: qualcomm: rmnet use-after-free), and CVE-2026-64189 (netfilter: ipset race condition). Debian has also addressed a Linux kernel vulnerability, CVE-2026-64191, concerning invalid length handling in I2C block transfers. Additionally, Dancer2 for Perl versions through 2.1.0 generate insecure session IDs when CSPRNG modules are unavailable (CVE-2026-13577).