Skip to dossier
←fruition.net
verified 4d ago
The Perimeter · Issue 11-13-2026

WordPress core RCE under active probing as PHP memory-corruption bugs get chained

The exploitable end of the stack moved this week. WordPress 7.1.4 patched an unauthenticated upgrade-window RCE (CVE-2026-119977) and CISA added it to KEV within days; Wordfence reports active probing. On the same KEV cycle, a PHP memory-corruption bug (CVE-2026-109618) is being chained with a Linux kernel ESP flaw to implant root webshells. Elsewhere: Next.js shipped a bundled security release, Incus/LXD disclosed a batch of host-compromise bugs including several CVSS 9.9 image-handling flaws, Sonatype documented twelve PolinRider loader drops in hijacked npm packages, and Keycloak got a JWT algorithm-confusion auth bypass. Recalculate patch priority this week around PHP runtime versions, WordPress core (not plugins), and any LXD/Incus hosts that accept untrusted images.
Published
Friday, November 13, 2026
Entries
12
Cadence
Weekly · Sundays
Curator
Brad Anderson
Wire
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
cisa.govNew addition to the Known Exploited Vulnerabilities catalog·
github.comGHSA: critical npm package compromise affecting CI pipelines·
wordfence.comWordPress plugin vulnerability with active exploitation·
drupal.orgHighly critical core security advisory published·
aws.amazon.comAWS security bulletin: IAM policy evaluation update·
unit42.paloaltonetworks.comThreat actor expands toolkit targeting public-facing PHP apps·
krebsonsecurity.comBreach disclosure with named victim and confirmed initial vector·
snyk.ioComposer dependency advisory affecting production framework versions·
01

Web Application

frameworks · browsers · authentication flows

portswigger.netthis week

PortSwigger: HTTP header injection escalated to request desync, now automated

PortSwigger research shows HTTP header injection can be escalated to a CRLF-powered request desync that serves arbitrary redirects to unrelated users. Burp Scanner now includes a scan check for the technique, meaning this class of bug will be found and reported at scale, not just by hand.

Fruition take

If any edge or app layer echoes user input into response headers without CRLF stripping, expect a scanner to find it now. Audit ingress-nginx and custom middleware for header reflection.

nextjs.org1w

Next.js November 2026 security release

The Next.js team published its November 2026 security release with patches available now. Teams running Next.js marketing surfaces should review the release notes and identify which of the bundled fixes apply to their version range before scheduling the upgrade.

Next.js
Fruition take

Pull the release notes into your next sprint; if any fix touches your version range, ship the upgrade before the holiday freeze window rather than after.

02

Supply Chain

packages · build systems · dependency attacks

github.comthis weekCVSS 9.9

Incus/LXD advisory wave: crafted images and snapshots reach the host as root

A coordinated batch of advisories landed for LXD/Incus, several rated CVSS 9.9. Crafted images with duplicate rootfs or templates symlinks give root-level host file read/write (GHSA-vghh-5rfx-xhq8, GHSA-jpf8-86f3-wp38), a crafted Incus-Image-Hash header gives arbitrary file write and root execution (GHSA-pjff-c2wc-f6jm), restricted-project snapshots bypass lowlevel blocking for root command execution (GHSA-47w9-6r3f-938g), and backup compression argument injection reaches the host (GHSA-fmc8-p6q7-75cc).

LXDIncus
Fruition take

If any cluster node runs LXD or Incus, inventory it now and upgrade before allowing any new image imports. Multi-tenant image pipelines are the highest-risk path.

blog.cloudflare.comthis week

PolinRider loader returns in 12 hijacked npm releases across 10 packages

Sonatype found runtime loaders in 12 npm releases across 10 hijacked packages, tied to the previously reported PolinRider campaign. The loaders decode payload-server IPs from Ethereum transactions sent to a hard-coded wallet, then fetch, XOR-decode, and execute JavaScript. Six hide the loader in eval(atob(...)); six use a character-permutation bootstrap via the Function constructor. No install hooks are needed; execution triggers when an affected entrypoint loads.

npm packages (10 hijacked)
Fruition take

Audit direct and transitive dependencies against Sonatype's package list, check internal mirrors and lockfiles, and treat any host that loaded affected code as compromised.

03

Infrastructure

kubernetes · cloud · network · ingress

github.comthis weekCVSS 9.3

kaniko leaks Azure Entra ID tokens to lookalike ACR registry hosts (CVE-2026-105769)

kaniko before v1.25.20 sends Microsoft Entra ID access tokens to attacker-controlled hosts. The Azure Container Registry credential helper matches registry hosts with an unanchored regex, so a Dockerfile referencing x.azurecr.io.attacker.com is enough; no RUN instruction or push is required. CVSS 9.3.

CVE-2026-105769kanikodocker-credential-acr-env
Fruition take

If CI builds images with kaniko against Azure Container Registry, upgrade to v1.25.20+ and audit recent build logs for non-ACR hosts; rotate any Entra ID credentials the build identity held.

aws.amazon.comthis week

AWS details cross-tenant reach in multi-tenant Kubernetes for unencrypted protocols

AWS security guidance covers protocol gaps in multi-tenant EKS clusters: ADB and WebRTC use unencrypted channels without enterprise auth like JWTs, and pods can reach other tenants' open ports by default unless network policies restrict them. The post walks the default-reachability problem and the policy configuration that closes it.

Amazon EKSKubernetes
Fruition take

Default-deny NetworkPolicies per namespace are the fix; if your clusters run mixed-tenant workloads, audit which pods have open, unauthenticated ports reachable cross-namespace.

04

PHP & CMS

wordpress · drupal · plugins · php frameworks

nvd.nist.gov1wKEV
▲ headline

WordPress core upgrade-window RCE (CVE-2026-119977) added to CISA KEV; attackers probing

WordPress 7.1.4 (released October 28, 2026) fixed CVE-2026-119977, a TOCTOU race in the core upgrade process. Predictable, web-accessible staging paths let unauthenticated attackers execute code on the server during a full-package core upgrade, leading to complete site compromise. Affects WordPress core 4.7 through 7.1.3; CISA added it to KEV and Wordfence reports attackers actively probing for the upgrade window.

CVE-2026-119977WordPress core 4.7-7.1.3
Fruition take

Confirm every WordPress site you manage is on 7.1.4 or a backported branch release, not just the latest plugin set. Automated core updates during low-traffic windows are the practical mitigation for the race itself.

drupal.orgthis week

Drupal security wave: Simple OAuth privilege escalation and Content Synchronizer RCE

The Drupal Security Team published roughly 20 advisories on November 4. Two stand out: Simple OAuth (CVE-2026-122058) lets users who can edit consumers mint tokens with escalated privileges up to full admin, and Content Synchronizer (CVE-2026-118547) allows PHP object injection to remote code execution via a crafted import archive. Other criticals include REST API Authentication access bypass (CVE-2026-122067) and S3 File System CORS Upload file deletion (CVE-2026-122057).

CVE-2026-122058CVE-2026-118547CVE-2026-122067+1 moresimple_oauthcontent_synchronizerrest_api_authentications3fs_cors
Fruition take

Run drush pm-update against the SA list this week, prioritizing simple_oauth and content_synchronizer. If Content Synchronizer imports ran recently from untrusted sources, treat the site as potentially compromised.

05

Identity & Auth

oauth · saml · iam · session attacks

github.com1wCVSS 8.1

Keycloak JWT algorithm confusion enables authentication bypass (CVE-2026-11800)

A JWT algorithm confusion flaw in Keycloak's JWT Authorization Grant flow (CVSS 8.1) lets an attacker with valid client credentials forge assertions that bypass signature verification, minting unauthorized access tokens and impersonating any federated user linked to the affected identity provider.

CVE-2026-11800Keycloak
Fruition take

If your client portals federate through Keycloak, patch and rotate the affected client credentials; assume any principal with valid client credentials could have forged tokens before the fix.

blog.cloudflare.com1w

Cloudflare tracks exploitation of eMudhra certificates with 4-bit effective key strength

Cloudflare documents eMudhra certificates whose keys are effectively breakable with four guesses, allowing decryption of unpatched TLS connections. Cloudflare patched its own estate and reports evidence of attempted exploitation in telemetry, with a large share of the rest of the internet still exposed. The post includes patching-rate observations.

eMudhra certificates
Fruition take

Check CT logs and your certificate inventory for eMudhra-issued certs and reissue from a different CA. Anything TLS-terminated with one of these keys should be considered readable in transit until rotated.

06

Threat Intel

active exploitation · breaches · ransomware

nvd.nist.gov2wKEV
▲ headline

PHP memory-corruption RCE (CVE-2026-109618) in the wild, chained with Linux kernel ESP bug

CISA added CVE-2026-109618, an unauthenticated remote code execution memory-corruption bug in PHP, to the KEV catalog. The KEV entry for Linux kernel CVE-2026-46300 states the kernel flaw can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Unit 42 has a threat brief covering both PHP issues.

CVE-2026-109618CVE-2026-109619CVE-2026-46300PHPLinux kernel
Fruition take

Patch the PHP runtime itself and restart all PHP-FPM pools; updating WordPress or Drupal does not update PHP. If hosts run unpatched kernels, treat the combined chain as root-compromise risk and patch both layers this week.

therecord.mediathis week

Certificate authority DigiCert discloses breach of internal business system

DigiCert reported that over the summer an internal business system was externally accessible when it should not have been, and someone created an unauthorized account on it. The breach involves business customer information. Given the victim's role as a certificate authority, the disclosure warrants scrutiny even though no certificate-issuing infrastructure is reported affected.

DigiCert
Fruition take

If DigiCert is your CA, watch for direct notification and confirm the incident did not touch issuance systems before your next certificate renewal cycle.