Weekly AppSec Threat Digest: WordPress Upgrade RCE in KEV, Rails File Write, Ivanti Zero-Days

The web's most widely used content management system had a remote code execution window that opens while it updates itself. CISA added the WordPress core upgrade race (CVE-2026-119977) to its Known Exploited Vulnerabilities (KEV) catalog on November 3, six days after WordPress 7.1.4 shipped and while Wordfence was still blocking more than 12,000 attempts a day against staged installer paths.

The rest of the week was about trust placed in the wrong layer. Ivanti fixed the last two links of the Connect Secure zero-day chain it first patched in October. Rails found that merely attaching an uploaded image let ImageMagick write files. Node-RED editors left without authentication were taken over with a single request. And a tampered analytics script turned ordinary websites into delivery points for mobile exploit chains. On the research side, PortSwigger escalated header injection to a desync with one prompt, and Google put $250,000 on the table for a full Google Cloud tenant takeover.

Lead story: a WordPress core upgrade race joins KEV

During a full-package core update, affected WordPress versions extracted the new release into a predictable directory inside the web-served wp-content/upgrade/ folder, and that staged copy includes the WordPress installer. An unauthenticated attacker who requests the staged files at the right moment — before WordPress moves them into place and cleans up — can reach code execution on the server. Umut Bayram of Picus Security reported it; WordPress fixed it in 7.1.4 on October 28 and backported the fix to every branch still receiving security updates, back to 4.7.

• Two severity ratings. WordPress's own advisory (GHSA-4w3m-c66w-69mg) rates the issue Low; Wordfence scores it CVSS 8.1. The narrow timing explains the gap, but KEV status settles the argument: CISA added it on November 3 with a November 6 federal deadline.
• Attackers did not wait. Wordfence counted more than 18,500 requests to staged installer paths in the first 21 hours after disclosure, and was still blocking more than 12,000 attempts a day this week. Honeypot telemetry cited by The Hacker News recorded exploitation attempts as early as October 30.
• The window reopens with every update. On a vulnerable install, each full-package core update — including automatic background updates — opens it again. Wordfence's lab tests put the window at only seconds, which is why attackers poll rather than strike once.

Remediation: confirm every site reports 7.1.4 or the fixed release for its branch (7.0.8, 6.9.11, 6.8.12 and so on, down to 4.7.39). Auto-updates usually take care of this; sites with updates disabled or pinned versions do not. At the web server, deny HTTP access to wp-content/upgrade/ — between updates it should hold nothing but an index.php, and Patchstack notes that a WordPress-level firewall cannot block the attack because the staged copy runs its own files. Then check access logs for requests to PHP files under that path, and look for unexpected administrator accounts, plugins or PHP files created around past update times. The bug is a textbook time-of-check/time-of-use race; our guide to verifying web race conditions explains why timing bugs like this are so often under-rated. See the WordPress 7.1.4 release, the GitHub advisory, CISA's alert, The Hacker News and webhosting.today's summary of the Wordfence and Patchstack guidance for hosts.

Actively exploited this week

CVE-2026-111357 and CVE-2026-118527 — Ivanti Connect Secure completes the zero-day chain (KEV)

In our October 9–16 digest we covered CVE-2026-104935, the Connect Secure authentication bypass that Volexity caught a threat actor it tracks as UTA0576 exploiting. Ivanti has now fixed the other two bugs in that chain: CVE-2026-111357 (CVSS 8.8), a missing-authentication flaw that lets a local authenticated attacker escalate privileges, and CVE-2026-118527 (CVSS 4.3), a predictable-identifier bug that lets an authenticated attacker upload attacker-controlled content to a known location on disk. Chained behind the bypass, the three gave unauthenticated root code execution on fully patched appliances, with exploitation dating back to at least October 1. CISA added both new CVEs to KEV on October 30.

Two details matter for responders. First, the October 13 builds (25.1.1.2 and 22.8R2.5) are still vulnerable to the new CVEs; the fixed releases are 25.1.1.3 and 22.8R2.6. Second, UTA0576 deployed no web shell or malware: it re-exploited the device for each command and tampered with logs, which let it evade Ivanti's Integrity Checker Tool. Rapid7 reports credential theft and Active Directory queries for LAPS passwords and BitLocker recovery keys. Remediation: upgrade, preserve memory and logs before any reset, rotate every credential the appliance could reach, and hunt with Volexity's published indicators and YARA rules — a clean Integrity Checker result does not rule out compromise. And note the scoring lesson: a CVSS 4.3 file-upload bug was a necessary link in a root chain. See BleepingComputer, Help Net Security and Volexity's original analysis.

CVE-2026-58115 — Node-RED editors without authentication, hijacked (CVSS 10)

VulnCheck's canaries recorded a complete exploit on October 30: a single HTTP request to an unauthenticated Node-RED admin API deployed a flow that downloaded a Linux bot into the RAM-backed /dev/shm and ran it. By November 1 the same source was also planting persistent web shells — an http in endpoint wired to an exec node — which survive the reboot that clears the in-memory implant. The CVE was assigned by Siemens for the Node-RED bundled in SIMATIC IoT2050 Advanced devices (fixed in 4.3.4.1), but the scanning targets any Node-RED instance running without adminAuth. VulnCheck added it to its own KEV list; it was not in CISA's catalog as of November 4.

Remediation: never expose the Node-RED editor or admin API to the internet, enable adminAuth, and review deployed flows for unexpected exec nodes or HTTP endpoints — including on instances embedded in OT and IoT equipment. A low-code automation editor is a remote shell by design and needs the same perimeter as one. See VulnCheck's report and SecurityWeek.

CVE-2026-107441 — the Zyxel GS1900 zero-day behind “patched” switch hacks

GreyNoise had attributed a campaign that compromised 996 GS1900 switches in 48 countries, starting around August 17, to CVE-2026-7273 — a pre-authentication overflow Zyxel fixed in June and CISA added to KEV on September 21. Binarly then recovered the actual exploit from exposed attacker infrastructure and showed it still worked against every firmware release patched for CVE-2026-7273, by corrupting a parameter counter before it was validated. Zyxel assigned CVE-2026-107441, an out-of-bounds write in the web management interface that gives unauthenticated attackers OS command execution, shipped fixed firmware on October 22 and published its advisory on November 3. Remediation: install the latest GS1900 firmware and keep switch management interfaces off untrusted networks. The lesson travels well beyond switches: “patched for the KEV CVE” is not the same as “safe from the campaign.” See Binarly's analysis and BleepingComputer.

Still exposed: GitLab CVE-2026-97229 days after its KEV listing

Last week's KEV listing for the GitLab CI regex RCE has not translated into patching. BleepingComputer reported on November 2 that Shadowserver still counted more than 1,000 internet-exposed instances vulnerable to CVE-2026-97229, and over 11,300 vulnerable to the other October regex RCE, CVE-2026-110264, out of roughly 39,000 GitLab instances it sees daily. If you run self-managed GitLab, move to the latest patch release for your line and confirm the Ruby it actually runs, as we described last week. See BleepingComputer.

Critical web application CVEs (no exploitation reported)

GHSA-f3w6-w445-fwh9 — Rails Active Storage: an attached upload writes files (CVSS 9.8)

ImageMagick chooses a “coder” from a file's content, not its name, and some coders read or write other files named inside the image — the MSL scripting coder is the classic example. Active Storage never restricted which coders an upload could reach, and its ImageMagick analyzer runs as soon as a file is attached: no variant, preview or explicit analysis call is needed. An attacker who can upload a file could therefore trigger arbitrary file writes, and on apps using the Disk storage service also file reads, including secret_key_base and credentials. Rails rates it critical (CVSS 9.8) and notes that one attack chain was reported but others may exist. RyotaK of GMO Flatt Security reported it through HackerOne.

An app is exposed only when all three hold: it processes images with variant_processor = :mini_magick (the default for apps on load_defaults 6.1 or earlier); its ImageMagick policy does not block the relevant coders — Rails says the Debian and Ubuntu default policies do not; and it accepts uploads from untrusted users.

Remediation: upgrade to activestorage 8.1.4.1 or 8.0.5.2; apps on mini_magick also need mini_magick 5.1 or later, or they raise an error at boot. The fixed releases ship an ImageMagick policy that denies MSL, Ghostscript, file-access and remote-fetch coders, the gs delegate and @filename indirection. It is not applied if your app replaces MiniMagick.cli_env, uses MiniMagick.cli_prefix or installs its own MiniMagick::Shell; GraphicsMagick users get no protection from it; and a server policy.xml rule that allows a coder — wildcards included — overrides the block. Check the policy that is actually loaded:

bin/rails runner 'puts MiniMagick.identify { |i| i.list "policy" }'

If you cannot upgrade yet, copy the shipped rules into the system policy (for example /etc/ImageMagick-7/policy.xml), at minimum denying MSL, the Ghostscript coders and the gs delegate. If Disk-stored attachments were reachable, rotate secret_key_base and every secret the process can read. Rails 8.0 receives security fixes only until November 7, 2026 and older series get none, so plan the move to 8.1 now. The same releases fix GHSA-v924-7rp8-4mxh (CVSS 8.8), where temporary filenames kept the upload's extension and could steer which decoder processed it. For how to prove an upload bug like this end to end, see verifying an exploitable file upload. Read the Rails advisory and The Hacker News coverage.

Apache OFBiz 24.09.08 — 46 CVEs, several unauthenticated

The OFBiz project's November 4 release fixes 46 vulnerabilities affecting all earlier versions. The headline bugs need no account: pre-authentication RCE through attacker-controlled screen-definition loading (CVE-2026-68524) and through login-page widget injection (CVE-2026-83542), a hard-coded cryptographic key in JWT authentication that grants unauthenticated admin access (CVE-2026-105330), REST endpoints that skip authentication by default when the auth attribute is omitted (CVE-2026-92887), and a flawed password-reset algorithm that enables account takeover (CVE-2026-109928). The rest reads like a business-logic test plan — view-only and other low-privileged users changing order prices, payment allocations and account balances — plus SSRF, XXE and SQL injection. Three earlier OFBiz CVEs are already in CISA's KEV catalog, so expect exploit development to be quick. Remediation: upgrade to 24.09.08 and keep OFBiz back-office interfaces off the internet. See the oss-security announcement.

CVE-2026-116606 + CVE-2026-111560 — Barracuda ESG chain to root

Mandiant reported two bugs that combine into root on Barracuda's Email Security Gateway. CVE-2026-116606 (CVSS 9.3) lets an attacker invoke the configuration-import function and restore a crafted backup, rewriting the global configuration on ESG versions before 9.4.0.030; Mandiant describes it as unauthenticated, while Barracuda's own wording is inconsistent. CVE-2026-111560 (CVSS 8.6) is a command injection that lets an administrator run OS commands as root; because the vulnerable code is shared, it also affects Load Balancer ADC, Message Archiver, WAF Control Center, the Web Application Firewall and Web Security Gateway. Neither is reported as exploited, but ESG was the target of a long-running espionage campaign through CVE-2023-2868, which is in KEV. Remediation: confirm the patches actually installed, re-enable automatic patching if it was turned off, and restrict administrative interfaces to trusted internal networks. See Barracuda's advisory, Mandiant's MNDT-2026-0042 and SecurityWeek.

Under your web stack: OpenSSH, APT, SonicWall GMS and Brotli

• OpenSSH password bypass on musl / Alpine (fixed in 10.6p2) — musl's crypt() returns * for SHA-crypt passwords longer than 256 bytes, which matches the * password field of accounts with no password set: key-only users, directory-service users and the alpine user in tiny-cloud images. With PasswordAuthentication yes (Alpine's default, built without PAM) and any local $5$ or $6$ hash present, a 257–1,024-byte password logs in. root also ships as root:*, but the default PermitRootLogin prohibit-password protects it unless changed or another account can become root. Alpine 3.16 through 3.24 and edge are affected; no CVE yet and no reported exploitation. Install the fixed package and restart sshd, or set PasswordAuthentication no; check Alpine-based containers that run sshd too. (Alpine advisory)
• APT CVE-2026-109518 (CVSS v4 7.7 per Ubuntu) — an attacker who can tamper with HTTP package traffic, such as a malicious mirror or proxy, can use redirects and transient errors to make APT retry a download and swap a verified package for its own, running code as root. Retries are on by default from Debian 12 and Ubuntu 22.04. Update APT in base images and CI runners; the advisories offer no workaround. (Ubuntu CVE page)
• SonicWall GMS — CVE-2026-109593 (critical, unauthenticated file read) and CVE-2026-109594 (SQL injection) will never be patched because GMS reached end of life in October 2025. Retire or isolate it. (SNWLID-2026-0019)
• Brotli, continued — Cisco now lists 19 products affected by the exploited Brotli decoder flaw (CVE-2026-111497), with dozens more under investigation, and Splunk lists nearly a dozen. Vendor appliances belong in your Brotli inventory. (SecurityWeek)

Supply chain: when trusted code changes hands

“Poisoned Source”: a tampered analytics script serves mobile exploit chains — Sekoia, November 4

Sekoia documented a watering-hole campaign it attributes with moderate-to-high confidence to APT29. One of its three delivery routes is pure web supply chain: between August 27 and September 3 the attackers tampered with the Plerdy analytics tracker (a.plerdy[.]com/public/js/click/main.js), so every site embedding it made its visitors load an extra fingerprinting script. The other routes were JavaScript injected into compromised sites and lookalike domains that reverse-proxied real sites and appended script to every page. Profiled visitors received n-day exploit chains for iOS or Android with no interaction required. On November 4 CISA added one of the chain's bugs, Apple's 2024 pointer-authentication bypass CVE-2024-27834 (fixed in iOS 17.5 and Safari 17.5), to KEV.

It is the second time in a month that analytics tags have been shown to work as an exploit delivery network. In October, Report URI and iVerify's “DeadTag” research found more than 660 expired domains, still referenced by tags on thousands of websites, re-registered to sell visitor traffic — including to iPhone exploit kits — at an estimated 135 million visits a month. For site owners: a third-party script runs with your origin's full privileges. Remove tags for services you no longer use, monitor for new script sources, enforce an allowlist with Content Security Policy, and pin versioned vendor files with Subresource Integrity where the vendor supports it. See Sekoia's report, Report URI's DeadTag research and The Hacker News on the KEV listing.

OpsShield cPGuard: a security product's update channel ships a root shell

OpsShield says attackers used compromised credentials to reach its update distribution infrastructure on November 2 and pushed a malicious cPGuard update (versions 5.88.12 to 5.88.19). SecurityWeek, citing OpsShield's updated disclosure, reports that the intrusion began at the billing and licensing server — where the attackers had registered a trial account to study licensing traffic — that the fake update was uploaded with a stolen access key and distributed for about 70 minutes, and that it ran as root on an estimated 2,950 Linux hosting servers, collecting data and planting a hidden root shell. About 7,900 customer account records were also copied. Remediation: update to cPGuard 5.88.25 or later, which removes the shell, and treat affected servers' password hashes, root SSH keys, MySQL root passwords and shell history as exposed. See SecurityWeek.

CWPdoor, and the hunt for AI platform tokens

• CWPdoor — XLab found a trojanized cwpsrv, the web server behind Control Web Panel (formerly CentOS Web Panel), installed by a fake updater script. It stays dormant until it receives a signed, encrypted command in three X-Ngx-Integrity-* headers, and scrubs the trigger request from the access log. XLab counts more than 340,000 internet-exposed CWP instances; how the updater reached victims is not yet known. Check for the ngx_http_integrity_helper socket, replace the binary, upgrade and rotate panel credentials. (BleepingComputer)
• AI developer platforms — WorkOS, Northflank and Trigger.dev disclosed intrusions, part of at least a dozen hits on AI developer platforms in a month in which attackers mostly hunted stored customer secrets and AI access tokens they can resell. In the same week Truffle Security launched a free revocation program in which 16 issuers, including Hugging Face, Vercel, Twilio and RubyGems, revoke verified leaked keys within 14 days; Truffle says 81% of the keys it reported last year still worked six months later. (SecurityWeek, BleepingComputer)

Web application and AI security research worth your time

Making header injection critical with one prompt — PortSwigger Research, November 4

Tom Stacey shows how an HTTP request header injection — often triaged as low severity — escalates into a CRLF-powered desync that redirects other users' requests to an attacker's domain. The methodology is now encoded as Burp AT skills: locate where the injected header lands relative to the upstream Host header using status-code differences; validate the desync by fuzzing request-splitting prefixes until two or three distinct status codes appear; crawl for a redirect gadget driven by Host, X-Forwarded-Host or an absolute URL; then replay the split over fresh connections until responses redirect. The team deliberately stopped at a redirect rather than response queue poisoning to avoid hitting real users, and notes the redirect chains with web cache poisoning. Burp Scanner also gains a new HTTP Request Header Injection check.

Practical takeaway: re-rate header injection findings as potential desyncs, strip CR and LF from anything that reaches a header or the request line, and never build redirects from Host-derived values. Our guide to safely confirming HTTP request smuggling covers proving a desync without collateral damage. Read the research.

Escaping ChatGPT's preview sandbox through a popup — Check Point, November 5

ChatGPT renders HTML previews in nested sandboxed iframes and overrode window.open to require approval. But the outer frame carried allow-popups and allow-popups-to-escape-sandbox, so a page could create its own nested frame, call that frame's untouched open() and get a real, unsandboxed window. That window could silently send chat history and uploaded files to an attacker even with Lockdown Mode on, or host phishing and fake update prompts. OpenAI removed both permissions on September 18. Practical takeaway for anyone previewing user- or AI-generated HTML: grant the minimum sandbox tokens, never grant allow-popups-to-escape-sandbox to untrusted content, and remember that patching a function in one frame does nothing for frames the content creates itself. Read Check Point's write-up.

A symlink out of the agent sandbox: Docker Sandboxes CVE-2026-103916 — Endor Labs, November 3

An AI agent with write access to its workspace could plant a symlink in a parent path component; when the operator later ran sbx cp, the host-side CLI followed it, letting the agent read host files into the sandbox or overwrite existing host files the operator can write (CVSS 8.2). Three of the four symlink positions were unguarded, and a first fix in 0.48.0 was incomplete. Upgrade to 0.51.0, and treat copy commands an agent proposes as untrusted input. Read Endor Labs' analysis.

What exploited vulnerabilities have in common — Microsoft, November 2

Microsoft analyzed about 383,000 CVEs published since 1999 and found roughly 2,000 (about 0.5%) linked to real-world exploitation. Takeover classes — RCE, authentication bypass and local privilege escalation — make up 78% of the exploited set. Server-side RCE rises from 20% of published CVEs to 37% of exploited ones, while XSS falls from 15% to 4%. Citing CISA data, the analysis puts the median time from publication to KEV listing at three days for CVEs published in 2026 through September, while median patch time for network appliances exceeds a year. It is a strong data-backed case for ranking by exploitability rather than score, the argument we made in a 9.8 is not a priority. Read Microsoft's analysis.

Bug bounty highlights

Google Cloud VRP adds a $250,000 “Root-in-Cloud” tier

Announced October 30, the new top tier pays for demonstrating owner-level or full IAM control over arbitrary Google Cloud organizations or projects with no prior access, stolen credentials or user interaction; reports of RCE in Borg, Google's production infrastructure, are evaluated for it too. The rules are as notable as the money: researchers must stop probing the moment they get execution in Borg, may not escalate, extract production credentials or move laterally, and prove access cryptographically against a designated service account instead of touching customer projects. See Google's announcement.

Meta Muse: $1.2 million paid, $300,000 for a trusted proxy header

Meta shared the top findings from the bug bounty on Muse, its personal AI agent: 64 valid reports out of more than 630, and about $1.2 million paid. The largest award, $300,000, was a classic web bug — an authentication check trusted a header added by a local HTTPS proxy, and a migration that added a second proxy layer let outside requests carry that header, exposing conversations and tokens on internal pre-release machines. Two $90,000 awards went to prompt injection through a web page that mimicked the agent's tool-status messages, and to one-time-passcode formatting that slipped past email redaction. Trust that depends on network position breaks the moment the topology changes. See SecurityWeek's summary.

The pattern: “patched” is a version string, not a proof

WordPress's bug exists only for the seconds an update is running. Ivanti's first patch closed the entry point but left two links of the chain open for another two weeks. Zyxel's June fix did not stop the campaign blamed on the bug it fixed. And GitLab still had more than a thousand exposed instances four days after its KEV listing. In each case “patched” described a version number, not the absence of an exploitable path.

The other thread is trust granted by position: a header only a local proxy was supposed to set, an analytics script loaded from a vendor's domain, an update channel trusted because it came from the vendor, a symlink inside an agent's own workspace. None of these is exotic. Each is a place where an assumption about who can reach something quietly stopped being true — which is exactly what continuous, exploit-verified testing exists to catch.

What to do first: October 30 – November 6 action matrix

Sources and further reading

• WordPress (CVE-2026-119977) — WordPress 7.1.4 release, GHSA-4w3m-c66w-69mg, BleepingComputer, The Hacker News
• CISA — Known Exploited Vulnerabilities catalog, November 3 KEV alert
• Ivanti (CVE-2026-111357, CVE-2026-118527) — BleepingComputer, The Hacker News, Volexity
• Node-RED (CVE-2026-58115) — VulnCheck, Siemens SSA-834709
• Zyxel (CVE-2026-107441) — Binarly, Zyxel advisory · GitLab — BleepingComputer
• Rails — GHSA-f3w6-w445-fwh9, GHSA-v924-7rp8-4mxh, Rails maintenance policy
• Apache OFBiz — oss-security announcement · Barracuda — advisory, SecurityWeek
• OpenSSH — Alpine advisory · APT — Ubuntu CVE-2026-109518 · SonicWall — SNWLID-2026-0019
• Supply chain — Sekoia: Poisoned Source, Report URI: DeadTag, SecurityWeek: cPGuard, BleepingComputer: CWPdoor, SecurityWeek: AI platform breaches
• Research — PortSwigger: header injection with one prompt, Check Point: ChatGPT Lockdown Mode bypass, Endor Labs: Docker Sandboxes, Microsoft: what exploited vulnerabilities have in common
• Bug bounty — Google Cloud VRP: Root-in-Cloud tier, SecurityWeek: Meta Muse findings