Two of this week's items are about software that is supposed to update itself and the third is about phones that didn't. WordPress fixed a bug in its own update process, and CISA now says attackers are exploiting it. Barracuda released patches for its email, web, and archiving appliances. And researchers documented a campaign that hijacked phones through ordinary websites, using only flaws Apple and Google had already fixed.
If your Milwaukee or Southeast Wisconsin office has a WordPress website, a Barracuda appliance, or phones that get work email, this is the week to check on them.
WordPress: confirm your site is on 7.1.4 or your branch's fixed release
What happened
On October 28, WordPress released 7.1.4, a security release with a long list of fixes. The most serious, CVE-2026-119977, is a race condition in the core update process. While WordPress unpacks a full core update, it briefly puts files in a predictable, web-accessible folder under wp-content/upgrade. An attacker who requests the right file at the right moment can run code on the server without logging in. Wordfence, which assigned the CVE, says the window normally lasts only seconds, but attackers are polling sites over and over to catch it. Wordfence recorded more than 18,500 requests to those staging paths in the first 21 hours after its firewall rule went out.
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3.
Who is affected
WordPress sites running versions 4.7 through 7.1.3 that have not installed the fix. WordPress backported the fix to older branches. Wordfence lists the patched versions, including 7.1.4, 7.0.8, 6.9.11, and 6.8.12, and back to 4.7.39. WordPress 4.6 and earlier get no security updates at all.
What to check or fix now
- Log in to each WordPress site, go to Dashboard > Updates, and confirm the version is 7.1.4 or the patched release for your branch. Do not assume automatic updates ran.
- If you use Wordfence, Wordfence says to make sure the firewall is set to Extended Protection, because this attack calls a PHP file directly without loading WordPress. Free users get the firewall rule on November 27, so the update matters more for them.
- If a site stayed unpatched for a while, look for requests to PHP files under
wp-content/upgrade, administrator accounts you don't recognize, plugins nobody installed, and PHP files you did not put there. - Run a malware scan after updating.
How to prevent it
Know who owns each website and who checks that its updates actually finished. Marketing sites built by an outside designer often get forgotten for years. Ask your web host or developer for the version number in writing. The same goes for plugins: we covered an earlier WordPress plugin problem in our October 7 threat brief on Ninja Forms.
Barracuda appliances: patches for flaws that can lead to root access
What happened
On November 2, Barracuda published an advisory for two flaws. CVE-2026-116606 is a pre-authentication authorization bypass in the Email Security Gateway, rated High with a CVSS score of 9.3. CVE-2026-111560 is a command injection flaw, rated High with a score of 8.6, that affects several products. Barracuda says that "if exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and obtain root access to the device." Successful exploitation requires access to the device's administrative interface. The advisory does not report any exploitation.
Who is affected
Per Barracuda's advisory:
- Email Security Gateway (ESG): both flaws. Patch BNSF-40425 for 9.4.017 and later, BNSF-40430 for earlier versions.
- Load Balancer ADC and Web Application Firewall: CVE-2026-111560. Patch BNADC-16586.
- Message Archiver: CVE-2026-111560. Patch BNMA-32468.
- WAF Control Center: CVE-2026-111560. Patch BNWF-60060.
- Web Security Gateway: CVE-2026-111560. Patch BNYF-24789.
The Canadian Centre for Cyber Security lists affected versions as, for example, ESG prior to 9.4.0.030 and Message Archiver prior to 5.5.4.0.
What to check or fix now
- Find every Barracuda appliance you own, including an old Message Archiver or web filter that nobody logs in to anymore.
- Confirm the patch for your product has been applied and the firmware is current. Barracuda says a device several versions behind may need more than one update. Its product-specific patch instructions are on Barracuda Campus.
- If automatic patching was turned off, Barracuda recommends turning it back on.
- Check whether the admin interface can be reached from the internet. Barracuda recommends limiting it to trusted internal networks.
How to prevent it
Keep admin pages for firewalls, email gateways, and appliances off the open internet. When an attack needs access to the admin page first, keeping that page private is what turns a critical bug into a scheduled update. For more on what the edge of your network should and should not expose, see why your business firewall matters more than you think.
Phones: website attacks that work only on iPhones and Android phones that missed updates
What happened
On November 4, the security firm Sekoia published research on a large watering hole campaign it attributes, with moderate to high confidence, to the Russian group APT29. The attackers compromised or cloned websites in the US, Ukraine, the Czech Republic, and Bulgaria, and also compromised a Ukrainian web analytics service used by hundreds of sites. Visiting an affected page was enough: a script checked the phone and browser version and then delivered an exploit chain with no further clicks. The payloads stole browser cookies and, in some cases, Wi-Fi passwords or full device data. Sekoia notes stolen cookies may let attackers reuse logged-in sessions, including webmail.
The important line for anyone managing phones: Sekoia says all three exploit chains "rely entirely on known, already-patched vulnerabilities" and none of them "work against fully updated devices." The chains it recovered targeted iOS 16.7, iOS 18.5, and Chrome for Android versions 139 to 145. Sekoia also found the payloads did not survive a restart.
Who is affected
iPhones and Android phones that are behind on updates, especially phones too old to get the current iOS version. This campaign was aimed at specific targets, but the same exploit code is out there, and Sekoia says one of the chains is a known iOS exploit kit.
What to check or fix now
- Check that company phones, and personal phones that get work email, are on the newest iOS version the device supports. Apple lists its current updates on its security releases page.
- On Android, update Chrome from the Play Store and install the latest system update.
- Restart phones after updating. Sekoia says these payloads stopped at reboot.
- If you think a phone was hit, sign that user out of all sessions in Microsoft 365 or Google Workspace and change the Wi-Fi password for any network the phone saved. For other Microsoft 365 settings worth a look, see our Microsoft 365 security checklist.
How to prevent it
If you manage phones with Intune or another MDM, set a minimum OS version so out-of-date phones cannot get to company email. Replace phones that no longer receive updates. For why a steady update routine matters, see why software updates are your first line of defense.
What to do this week
- Check every WordPress site in Dashboard > Updates and confirm it shows 7.1.4 or your branch's patched release.
- On any WordPress site that stayed unpatched, look for unknown admin accounts, plugins, and PHP files under
wp-content/upgrade. - Confirm the November 2 patch is applied on every Barracuda appliance, including older archivers and web filters.
- Make sure appliance and firewall admin pages cannot be reached from the internet.
- Update and restart company phones, and set a minimum OS version in your MDM if you have one.
If you need someone who can handle these checks for you, reach out to us. We would be happy to help.
Sources
- WordPress 7.1.4 release notes
- Wordfence, WordPress 7.1.4 patches unauthenticated upgrade-window RCE
- CISA adds one Known Exploited Vulnerability, November 3
- CISA Known Exploited Vulnerabilities catalog entry, CVE-2026-119977
- NVD, CVE-2026-119977
- Barracuda security advisory, November 2
- Barracuda Campus, product-specific patch instructions
- Canadian Centre for Cyber Security, AV26-1112
- NVD, CVE-2026-116606
- NVD, CVE-2026-111560
- Sekoia, "Poisoned Source: APT29 watering holes target mobile devices with n-day exploits," November 4
- Apple security releases
Powerful IT Systems · Sussex, WI
Hands-on IT experience serving Milwaukee-area businesses.