What you need to know today.
Critical vulnerabilities affect WordPress, Apple, Palo Alto Networks, Cisco, and Zyxel, with active exploitation of a WordPress flaw noted.
WordPress Core versions 4.7 through 7.1.3 are vulnerable to remote code execution (CVE-2026-119977) due to predictable, web-accessible staging paths during full-package core upgrades. This flaw allows unauthenticated attackers to execute arbitrary code. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. As The Hacker News and Cyber Security News report, this vulnerability has been detected in the wild, with exploitation attempts observed shortly after the release of WordPress 7.1.4, which includes a patch for this issue. Users are urged to update to the latest version to mitigate the risk.
Apple has released security updates for Safari, iOS, iPadOS, macOS, and visionOS to address a critical vulnerability in WebKit (CVE-2026-113897). This flaw could allow a remote attacker to break out of the Web Content sandbox. While the vulnerability was addressed by removing the vulnerable code, details are scarce. However, as reported by Cyber Security News and SANS Internet Storm Center, these updates are part of a larger release addressing numerous vulnerabilities, with Apple iOS 27.2 alone fixing 163 security issues.
A critical command injection vulnerability in Palo Alto Networks Expedition (CVE-2025-0107) allows unauthenticated attackers to execute arbitrary OS commands as the www-data user. This can lead to the disclosure of usernames and cleartext passwords, potentially compromising the entire system. The vulnerability stems from insufficient sanitization of user input within the Expedition platform, enabling attackers to inject malicious commands. Further details on the impact and potential exploitation vectors are still emerging.
Cisco Smart Software Manager On-Prem (SSM On-Prem) is affected by a critical authentication bypass vulnerability (CVE-2024-20419). An unauthenticated, remote attacker can exploit this flaw to change the password of any user, including administrative accounts. This could grant attackers full control over the system, allowing them to alter configurations, access sensitive data, or disrupt services. Organizations using SSM On-Prem should prioritize applying any available patches or workarounds from Cisco.
Zyxel NAS devices, specifically NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0, contain a critical command injection vulnerability in the remote_help-cgi program (CVE-2024-29972). This flaw, noted as UNSUPPORTED WHEN ASSIGNED, could allow an unauthenticated attacker to execute arbitrary commands on the affected devices, potentially leading to a full system compromise. Users are advised to check for and apply any available firmware updates from Zyxel.
HPE systems are impacted by a denial-of-service vulnerability in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 (CVE-2015-5477). Remote attackers can trigger a REQUIRE assertion failure and cause the daemon to exit by sending specially crafted TKEY queries. This vulnerability has been linked to exploitation by China-linked threat actors, as reported by The Hacker News and CISA, who have included it in their advisory regarding Chinese government-linked cyber threat actors. Organizations running vulnerable BIND versions should update immediately.