{
  "slug": "2026-11-02",
  "date": "2026-11-02",
  "updated": "2026-11-07",
  "title": "Run a WordPress site? It needs this month's fix",
  "intro": "A WordPress Core flaw under active attack needs an update if your site hasn't had it yet, a SonicWall firewall flaw is letting attackers bypass single sign-on logins protected by multi-factor authentication (MFA), and the National Anti-Scam Centre has flagged a marketplace payment scam worth knowing about before Black Friday.",
  "quietWeek": false,
  "items": [
    {
      "id": "wordpress-core-upgrade-rce",
      "rank": 1,
      "published": "2026-11-03",
      "title": "Run a WordPress website? It needs this month's update",
      "summary": "WordPress Core, the free software behind a huge share of small business websites, has a flaw that criminals are already using. It only opens up during the brief window while a site's software is being upgraded, when a predictable file location is briefly reachable on the open web, letting an attacker run their own code on the server without needing a password. WordPress fixed it in a security release in late October 2026, with patches also issued for older version branches. The flaw has been added to the US government's actively exploited vulnerability list, with a three-day fix deadline for US federal agencies, a sign of how seriously it's being treated.",
      "whoItAffects": "Any business with a self-managed WordPress website, the free WordPress.org software usually set up through a web host or developer. WordPress.com's fully-hosted paid plans update automatically and are not affected the same way.",
      "action": "Ask whoever manages your website: \"Has our WordPress site had the late-October 2026 security update applied, the one fixing CVE-2026-119977?\" If you manage it yourself, update to the latest version in your dashboard now.",
      "prevention": {
        "e8": "Patch applications",
        "ism": "Web application security"
      },
      "sourceKind": "kev",
      "cves": [
        "CVE-2026-119977"
      ],
      "links": [
        {
          "label": "CISA KEV entry",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-119977"
        },
        {
          "label": "WordPress 7.1.4 security release",
          "url": "https://wordpress.org/news/2026/10/wordpress-7-1-4/"
        }
      ],
      "cwes": [
        "CWE-367"
      ]
    },
    {
      "id": "sonicwall-sonicos-sslvpn-saml-mfa-bypass",
      "rank": 2,
      "published": "2026-11-06",
      "title": "Run a SonicWall firewall for VPN access? Patch it now",
      "summary": "SonicWall firewalls that use single sign-on (SAML) logins for their SSL VPN remote-access service have a flaw that lets someone with valid credentials for a different login method slip past that SAML check, and bypass any multi-factor authentication (MFA) enforced through it. SonicWall fixed it in SonicOS 7.3.4-7013 (Gen 7 firewalls) and 8.2.3-8015 (Gen 8 firewalls), and is investigating a report of abuse. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of actively exploited vulnerabilities on 6 November 2026.",
      "whoItAffects": "Businesses using a SonicWall firewall (Gen 7 or Gen 8) with SSL VPN remote access turned on and single sign-on (SAML) logins configured for it, often paired with MFA. If you don't use SAML for your SonicWall's VPN logins, or your firewall isn't a SonicWall, this doesn't apply to you.",
      "action": "Ask whoever manages your network: \"Is our firewall a SonicWall, and has it been updated to SonicOS 7.3.4-7013 or 8.2.3-8015 to fix the actively exploited login bypass, CVE-2026-19868?\"",
      "prevention": {
        "e8": "Patch operating systems",
        "ism": "Network security"
      },
      "sourceKind": "kev",
      "cves": [
        "CVE-2026-19868"
      ],
      "links": [
        {
          "label": "CISA KEV entry",
          "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19868"
        },
        {
          "label": "SonicWall advisory SNWLID-2026-0014",
          "url": "https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014"
        }
      ],
      "cwes": [
        "CWE-308"
      ]
    },
    {
      "id": "scamwatch-marketplace-seller-phishing",
      "rank": 3,
      "published": "2026-11-03",
      "title": "Selling something online? Watch for this payment scam",
      "summary": "Buying and selling scams are now the single biggest category of money lost to scams in Australia, 58.7% of all loss reports so far this year according to the National Anti-Scam Centre. One pattern it's flagging: sellers on online marketplaces are messaged claiming their item has sold, then sent a link to \"verify\" their account or \"receive payment\". The link leads to a fake page built to steal banking details instead, with one reported case losing $1,800 this way. Criminals are also using artificial intelligence (AI) to build convincing fake shopfronts, including fake car-sales sites copying a real business's own details.",
      "whoItAffects": "Anyone buying or selling through online marketplaces, including businesses selling spare equipment, stock or assets secondhand.",
      "action": "If a marketplace message tells you to click a link to verify your account or collect payment, don't: log in directly through the official app or website instead. If you've already entered details on a suspicious page, contact your bank immediately and turn on multi-factor authentication (MFA).",
      "prevention": {
        "e8": "Multi-factor authentication",
        "ism": "Cyber security awareness training"
      },
      "sourceKind": "scamwatch",
      "links": [
        {
          "label": "Scamwatch media update",
          "url": "https://www.scamwatch.gov.au/about-us/news-and-alerts/media-update-when-the-shopfront-is-a-scam"
        }
      ]
    }
  ]
}