Humor y tecnología de la mano
Joined August 2012
- Tweets2.9K
- Following270
- Followers106
- Likes3.5K
Compukiks retweeted
🚨 BREAKING: WordPress just patched 22 security vulnerabilities, including a flaw that could allow REMOTE CODE EXECUTION.
WordPress 7.1.4 was released TODAY, and administrators are being urged to update immediately.
Here’s what was discovered:
→ Remote Code Execution (RCE): A race condition during WordPress updates could allow attackers to execute code during the upgrade window.
→ Multiple Stored XSS Vulnerabilities: Flaws affecting WordPress blocks, the Interactivity API, and administrative features.
→ Unauthenticated Information Disclosure: Attackers could access unpublished Customizer changes without logging in.
→ Denial of Service: A vulnerability in the Interactivity API could disrupt site availability.
→ AI-Discovered Vulnerabilities: Anthropic researchers contributed findings, including security issues involving personal data removal requests and user accounts.
⚠️ ACTION REQUIRED: Update to WordPress 7.1.4 or the appropriate patched version for your branch. Verify that automatic updates actually completed.
Running WordPress? Lucid Security is offering free website security assessments to help identify potential exposure.
🌐 lucidsecurity.si
Source: wordpress.org/news/2026/10/w…
🤖 Made with AI
Compukiks retweeted
A PoC/exploit has been discovered for vulnerability CVE-2026-42530
PT ID: PT-2026-50439
Read on dbugs: dbu.gs/vulnerability/PT-2026…
Vendor: F5
Product: NGINX Open Source
Description: NGINX Open Source has a vulnerability in the ngx_http_v3_module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This may cause a Use-after-Free in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.
Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Link: github.com/udyz/cve-2026-425…
