Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time

thehackernews.com Nov 6, 2026

Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time

Curated by Shubham · TechCapsules · Nov 6, 2026

AI-summarised brief · reviewed before publication

WordPress sites can still be compromised while installing the patch for CVE‑2026‑119977, a flaw actively exploited in versions 4.7 through 7.1.3. Researcher Umut Bayram of Picus Security discovered that the updater unpacks the new package using the site’s existing, vulnerable code, creating a temporary wp‑content/upgrade folder that remains web‑accessible. An attacker who predicts the folder name can execute code, modify wp‑config.php and overwrite the live site before WordPress deletes the temporary copy. The fix, released in version 7.1.4 and back‑ported to older branches, randomizes the folder name, but the installation process itself still exposes the window. Bayram recommends blocking web access to wp‑content/upgrade or performing manual, off‑root updates. CISA added the vulnerability to its exploited‑vulnerabilities catalog after confirming active attacks.

💡 Why It Matters

· Because the updater runs vulnerable code before the patch is applied, routine updates can become a fleeting yet exploitable entry point, letting attackers seize control while administrators believe they are securing their sites.

Capsules Cybersecurity

Read full article on thehackernews.com

Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on…

A newly disclosed OpenSSH flaw, CVE‑2026‑123158 (SSHole), allows attackers to authenticate to accounts with no password set on musl‑based Linux systems, including Alpine Linux, by supplying oversized passwords. The vulnerability stems from a 2016 patch that misinterpreted failed hash attempts as successful logins when the account’s password field contains an asterisk. Within nine hours of disclosure, threat actors achieved root access on an Alpine honeypot, demonstrating the flaw’s immediacy. Users must upgrade to OpenSSH 10.6p2 and review logs for unauthorized password acceptance.

💡 The rapid exploitation underscores the urgency of patching OpenSSH on musl‑based distributions, as the flaw grants attackers full account privileges without credential theft. Prompt updates and vigilant log monitoring are essential to prevent potential lateral movement and infrastructure compromise.

thequantuminsider.com · Nov 6

ZeroTier Partners With Redapt to Deliver Post-Quantum Networking

ZeroTier announced a partnership with Redapt to embed its ZeroTier Quantum platform into Redapt’s infrastructure, cloud and managed‑service portfolio. The solution uses post‑quantum cryptographic standards ML‑KEM‑1024 (FIPS 203) and ML‑DSA‑87 (FIPS 204) to protect connectivity across data‑center, cloud and edge environments. Redapt will assess, design, deploy and manage the platform for enterprise clients while also providing cybersecurity advisory and virtual CISO services to ZeroTier. Both firms target sectors such as government, defense, finance and regulated gaming, offering a turnkey path to quantum‑resilient networking without redesigning existing architectures. ZeroTier Quantum, the first end‑to‑end quantum‑secure networking platform, incorporates the ZeroTier Transport Protocol with hybrid FIPS‑compliant post‑quantum encryption and perfect forward secrecy. The collaboration also includes joint go‑to‑market campaigns and shared support resources.

💡 Enterprises can now adopt quantum‑grade protection today, sidestepping costly network overhauls and mitigating long‑term data‑exfiltration risks.

thehackernews.com · Nov 6

Experts Demonstrate Barracuda Email Security Gateway Chain Enabling Root Access Without Login

Security researchers disclosed a two‑stage attack against Barracuda’s Email Security Gateway appliance that grants unauthenticated attackers root privileges without logging in. The chain combines CVE‑2026‑116606, an authorization bypass that lets a remote user restore a crafted configuration backup and alter global settings, with CVE‑2026‑111560, a command‑injection flaw that normally requires an admin account but is enabled by the bypass. Together they allow arbitrary root‑level commands on the gateway. Barracuda issued firmware patches on Monday, fixing the gateway in version 9.4.0.030 and updating five related products for the injection issue. Mandiant rated the bypass 9.3/10 and the injection 8.6/10. WatchTowr released a detection tool but no public exploit, and the vulnerabilities are not listed in CISA’s KEV catalog as of today.

💡 The exploit proves that even well‑protected email gateways can be compromised without credentials, forcing organizations to reassess firmware update policies and validation of backup mechanisms.

thehackernews.com · Nov 6

Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands…

Researchers at QiAnXin’s XLab discovered a backdoor embedded in the Control Web Panel (CWP) web server, a Linux hosting management tool. The malicious code, dubbed “cwpdoor,” replaces the legitimate cwpsrv binary for versions 1.15.10 and 1.24.0 and executes attacker‑supplied commands delivered via web requests that bypass access logs. Installation requires root privileges, indicating the attackers have already compromised the host. The backdoor masquerades as an update, restores file timestamps, and evades detection, showing zero hits on VirusTotal’s 63 scanners. A recent archive containing the payload was uploaded to VirusTotal from Brazil on September 30, suggesting active infections, though the exact number of compromised servers remains unknown. Researchers also noted the presence of the unrelated Ebury SSH backdoor in the same archive.

💡 The hidden backdoor lets intruders run commands without leaving traceable logs, giving them persistent, stealthy control over compromised Linux hosting environments.

thequantuminsider.com · Nov 6

QNu Labs Launches Corporate Training Programme on Quantum-Safe Security

QNu Labs has launched a 12‑hour corporate training programme through its QNu Academy, aimed at enterprise cybersecurity leaders. Backed by India’s National Quantum Mission, the three‑day course covers quantum key distribution, quantum random number generators, post‑quantum cryptography, cryptographic inventory management and emerging quantum threats. It targets CISOs, security strategists, risk and compliance officers, IT architects and senior security managers, offering assessment‑based certification and optional on‑site workshops for 15‑50 participants or half‑day executive briefings. Instructors include QNu engineers who have deployed quantum communications for banking, defence and secure systems, as well as professors from IITs, NITs, IIITs and IISERs. The programme seeks to equip organisations with the knowledge to assess quantum‑related risks and plan migration to quantum‑safe security for future resilience.

💡 Enterprises that ignore quantum‑ready cryptography risk having today’s encrypted data decrypted tomorrow, turning a strategic training investment into a defensive necessity.

thehackernews.com · Nov 6

Chainalysis Breach Exposes All Users’ Credentials, Forces Shutdown of Key Services

Blockchain analytics firm Chainalysis disclosed that a sophisticated agentic cyber‑attack uncovered the names, usernames, password hashes and live tokens of every user on its platform. While the breach prompted the immediate shutdown of its Reactor, Data Solutions, Know‑Your‑Transaction (KYT) UI, API and address‑screening services, the company said no evidence shows that investigation data or attribution records were accessed or altered. Chainalysis has locked affected accounts, halted password resets and is requiring users to reset passwords and rotate API keys once trusted IPs are added to an allowlist. The incident follows a prior multi‑front attack that revealed a subset of passwords and mirrors a wave of AI‑driven assaults targeting tech firms, including the use of autonomous tools like ARTEX to harvest secrets from public code repositories.

💡 The breach exposes the entire credential base of a leading crypto‑forensics provider, forcing a rare full‑service outage and compelling customers to overhaul authentication across their own systems.