WordPress Update Flaw Is Under Attack, Plus 3 Stories
A security update is usually the safest button on a website. Today’s lead is the uncomfortable exception: attackers are exploiting a WordPress flaw that exists during the update itself. That doesn’t make updating a bad idea. It makes verifying the finished update a website security job, not a clerical one.
Attackers are targeting WordPress during core updates
WordPress released version 7.1.4 on October 28 to fix several security problems. The most serious one, CVE-2026-119977, affects WordPress 4.7 through 7.1.3. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, which means this has moved beyond a laboratory demonstration. Attacks are happening.
The mechanism matters because the headline sounds almost backward. During a full core update, WordPress extracts the new package into a temporary directory under wp-content/upgrade, checks the expected package files, and then copies the staged files into the live site. The temporary path is predictable and can be reached from the web on affected installations. An attacker who hits that brief window can place a replacement wp-config.php in the staging area after the check but before the copy. Security people call that a time-of-check to time-of-use race. In normal language, the package passes inspection and then someone swaps a file before delivery.
Researcher Umut Bayram’s analysis describes one path from there: the replacement configuration points the site at an empty database, WordPress exposes its setup flow, and the attacker creates the first administrator account. On a typical single-site installation, that administrator can upload a malicious plugin and run PHP code on the server.
The action is straightforward. Update to WordPress 7.1.4 or later. If a site must remain on an older branch, install the newest security backport available for that branch, then plan the move to a supported release. Don’t stop at “automatic updates are enabled.” Check the actual version on every production site, confirm the front end and admin area still behave normally, and review administrator accounts and recent file changes. A clean backup made before the update is useful, but only if the same compromised account can’t erase the backup along with the live site. WordPress’s release notice recommends updating immediately.
For a business with several WordPress sites, inventory is the first control. If nobody can name every installation, its version, hosting account, update owner, and last verified backup, one forgotten marketing site becomes the soft edge of the network. After patching, check update logs for failed or unusually timed upgrades and compare critical files against a known-good copy. This flaw attacks a narrow moment, but an attacker who succeeds can leave persistent access behind.
WordPress security & maintenance
Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.
mSecure says an encrypted cloud database was stolen
Password manager maker mSeven has warned current and former mSecure customers after an intruder acquired an encrypted database from mSecure Cloud. The company says the incident was limited to people who synchronized through its cloud service and that it has no evidence the confidential contents were decrypted. Its notice still tells affected customers to change important stored passwords, reset or re-enroll two-factor authentication, and replace existing passkeys.
Those statements aren’t contradictory. Encryption can keep a stolen vault unreadable, but possession of the encrypted database gives an attacker time to guess master passwords offline. There’s no website login screen to slow each attempt or lock the attacker out. A long, unique master password is a much harder target than a short or reused one.
Changing the mSecure master password protects the account going forward, but it can’t rewrite the copy already stolen. The practical priority is to rotate credentials inside the vault, starting with email, financial accounts, domain registrars, cloud administration, and anything that can reset other accounts. Then replace stored recovery codes, two-factor secrets, and passkeys where applicable. This is tedious work, unfortunately. It’s also why the company needs to publish more than a support-forum response: customers still need a clear incident timeline, the exact data fields taken, and enough detail about the password-derivation settings to judge the offline-cracking risk. BleepingComputer has the current disclosure details, while mSecure’s support thread shows the company’s response and the unanswered questions.
Business IT goes well beyond the website
Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.
Zyxel patches GS1900 switches after nearly 1,000 compromises
Zyxel has patched CVE-2026-107441, an out-of-bounds write in the web management interface of ten GS1900 switch models. An unauthenticated attacker who can reach the device over the network can send a specially crafted HTTP request and execute operating-system commands. Researchers traced attacks to 996 switches in 48 countries, with intruders collecting device configurations, hashed root credentials, and network information.
The affected models are GS1900-8, -8HP, -10HP, -16, -24, -24E, -24EP, -24HPv2, -48, and -48HPv2. Zyxel’s model-by-model advisory lists vulnerable 2.90 firmware ending in “.2” or earlier and fixed releases ending in “.3.” Install the exact fixed build for the model, and don’t assume an earlier Patch 2 update solved this. Researchers found the attack still worked against firmware that had fixed a different flaw.
After patching, treat an exposed switch as potentially compromised, not magically cleansed. Restrict its management page to an administration network or VPN, rotate device credentials, compare the configuration with a known-good copy, and investigate unfamiliar accounts, settings, or outbound traffic. A switch is infrastructure. If an attacker learns how the network is built, the problem can travel well beyond the switch.
Technology is rarely just about the technology
Some of the most important technology stories aren’t product launches at all. They’re about health, privacy, education, law, accessibility, work, and what happens when technology reaches ordinary people. Browse more Raymond Tec News for the stories worth understanding without the hype.
Blood-storage alarms turned an attack into a recovery test
A cyberattack that disrupted refrigeration controls at European supermarkets also reached three French Blood Establishment facilities on November 2. Attackers changed temperature or defrost settings, but this time the story didn’t end with lost inventory. Round-the-clock staff received alarms and moved blood products into refrigerators that weren’t connected to the affected systems. Officials said no blood was lost and supplies weren’t disrupted. Remote access to the affected units was disabled while the investigation continued.
That’s a material update to the refrigeration attacks covered earlier this week. The defensive lesson isn’t “disconnect everything.” It’s that connected control systems need independent alarms, people authorized to act, spare capacity, and a recovery path that doesn’t depend on the same network. The refrigerators were still attacked. The difference was that one compromised control path didn’t become a blood-supply crisis. That’s what resilience looks like when it has to work at three in the morning.
Keeping a website running is its own job. Raymond Tec provides website security and maintenance, including updates, backups, monitoring, access cleanup, recovery planning, and help when something has already gone sideways.
Sources / Further Reading
- WordPress 7.1.4 security release
- NHS England cyber alert for CVE-2026-119977
- Picus Security technical analysis
- BleepingComputer on the mSecure incident
- Zyxel GS1900 security advisory
- BleepingComputer on the Zyxel compromises
- Reuters on the French blood-storage incident
Photo by Ray Suarez on Pexels.
