Run a WordPress site? It needs this month's fix

Week of 2 to 8 November 2026

A WordPress Core flaw under active attack needs an update if your site hasn't had it yet, a SonicWall firewall flaw is letting attackers bypass single sign-on logins protected by multi-factor authentication (MFA), and the National Anti-Scam Centre has flagged a marketplace payment scam worth knowing about before Black Friday.

1. 1

   Run a WordPress website? It needs this month's update3 Nov

   Any business with a self-managed WordPress website, the free WordPress.org software usually set up through a web host or developer. WordPress.com's fully-hosted paid plans update automatically and are not affected the same way.

   WordPress Core, the free software behind a huge share of small business websites, has a flaw that criminals are already using. It only opens up during the brief window while a site's software is being upgraded, when a predictable file location is briefly reachable on the open web, letting an attacker run their own code on the server without needing a password. WordPress fixed it in a security release in late October 2026, with patches also issued for older version branches. The flaw has been added to the US government's actively exploited vulnerability list, with a three-day fix deadline for US federal agencies, a sign of how seriously it's being treated.

   Do this

   Ask whoever manages your website: "Has our WordPress site had the late-October 2026 security update applied, the one fixing CVE-2026-119977?" If you manage it yourself, update to the latest version in your dashboard now.

   Essential Eight: Patch applicationsISM: Web application security

   Sources: CISA KEV entry ↗ · WordPress 7.1.4 security release ↗CVE-2026-119977 · CWE-367

2. 2

   Run a SonicWall firewall for VPN access? Patch it now6 Nov

   Businesses using a SonicWall firewall (Gen 7 or Gen 8) with SSL VPN remote access turned on and single sign-on (SAML) logins configured for it, often paired with MFA. If you don't use SAML for your SonicWall's VPN logins, or your firewall isn't a SonicWall, this doesn't apply to you.

   SonicWall firewalls that use single sign-on (SAML) logins for their SSL VPN remote-access service have a flaw that lets someone with valid credentials for a different login method slip past that SAML check, and bypass any multi-factor authentication (MFA) enforced through it. SonicWall fixed it in SonicOS 7.3.4-7013 (Gen 7 firewalls) and 8.2.3-8015 (Gen 8 firewalls), and is investigating a report of abuse. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of actively exploited vulnerabilities on 6 November 2026.

   Do this

   Ask whoever manages your network: "Is our firewall a SonicWall, and has it been updated to SonicOS 7.3.4-7013 or 8.2.3-8015 to fix the actively exploited login bypass, CVE-2026-19868?"

   Essential Eight: Patch operating systemsISM: Network security

   Sources: CISA KEV entry ↗ · SonicWall advisory SNWLID-2026-0014 ↗CVE-2026-19868 · CWE-308

3. 3

   Selling something online? Watch for this payment scam3 Nov

   Anyone buying or selling through online marketplaces, including businesses selling spare equipment, stock or assets secondhand.

   Buying and selling scams are now the single biggest category of money lost to scams in Australia, 58.7% of all loss reports so far this year according to the National Anti-Scam Centre. One pattern it's flagging: sellers on online marketplaces are messaged claiming their item has sold, then sent a link to "verify" their account or "receive payment". The link leads to a fake page built to steal banking details instead, with one reported case losing $1,800 this way. Criminals are also using artificial intelligence (AI) to build convincing fake shopfronts, including fake car-sales sites copying a real business's own details.

   Do this

   If a marketplace message tells you to click a link to verify your account or collect payment, don't: log in directly through the official app or website instead. If you've already entered details on a suspicious page, contact your bank immediately and turn on multi-factor authentication (MFA).

   Essential Eight: Multi-factor authenticationISM: Cyber security awareness training

   Sources: Scamwatch media update ↗

Latest ISM release: ISM September 2026: What Changed and What to Check →What the ISM is and how we assess it →