Tech News Today – Latest Gadget & AI Updates

Home
WordPress Core Vulnerability Now Under Active Attack

A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, six days after WordPress shipped the fix in version 7.1.4. Any site still running an affected version should update today, and any site that updated recently should check its logs for signs of intrusion.

Key Takeaways:
- - CISA added CVE-2026-119977 to the KEV catalog on November 3, 2026, citing evidence of active exploitation.
- - The flaw affects WordPress core versions 4.7.0 through 7.1.3 and is fixed in 7.1.4, released October 28, 2026.
- - Exploitation requires no account, but it only works during the seconds-long window when a core update is unpacking.
- - Federal civilian agencies face a remediation deadline of November 6, 2026.
What CISA added and when

The November 3 alert is short and specific. CISA lists CVE-2026-119977 as a WordPress Core time-of-check time-of-use race condition vulnerability, added to the catalog based on evidence of active exploitation. The agency ties remediation requirements to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid fixes for catalog entries on internet-exposed assets that grant total control after exploitation.

The practical deadlines differ by audience. Federal agencies were given until November 6, 2026 to remediate, according to GBHackers. Private organizations face no legal deadline, but the KEV listing is the closest thing the US government publishes to a confirmed-attack signal, and CISA encourages all organizations to treat catalog entries as urgent.

How the flaw works

During a core update that uses a complete package, affected versions of WordPress unpack the new files into a predictable directory inside the web-served upgrade folder before replacing the live installation. An attacker who requests a file from that directory at the right moment, before the files are cleaned up, can get code executed by the server.

The GitHub security advisory describes it as a race condition and rates the practical window as brief. Two conditions make it exploitable: the site must be performing a full-package core update, and the upgrade directory must be reachable over the web. That combination is common on shared hosting and on sites that rely on automatic background updates, which is exactly how most WordPress installations are maintained.

Why the ratings disagree

Severity scores for this bug range widely, and the gap is worth understanding because it shapes how urgently different teams respond. Wordfence, acting as the CVE numbering authority, scored CVE-2026-119977 at 8.1, or high, on the CVSS 3.1 scale. WordPress' own security team treats the upgrade-process issue as low severity, and the GitHub advisory labels it low.

Both ratings can be correct at once. The CVSS score measures impact if exploited, which is total: code execution means full loss of confidentiality, integrity and availability for the site and often for anything sharing its database. The low rating reflects difficulty, since the attacker has to win a race measured in seconds and cannot trigger the update directly on demand. CISA's KEV listing resolves the argument in favor of treating it as urgent, because exploitation has now been observed rather than theorized.

Who is exposed

Versions 4.7.0 through 7.1.3 carry the flaw. WordPress shipped fixes on October 28, 2026 for every supported branch, from 7.1.4 down to 4.7.39, and sites running 4.6 or earlier will never receive a patch because those branches are out of support.

The exposure profile is broader than a single website. Agencies and hosts that manage many installations, including marketing sites, regional microsites and campaign pages, often run older core versions because nobody owns them. Those are the sites most likely to sit unpatched past the KEV deadline, and they are also the sites least likely to have logging that would reveal an intrusion.

What to do in the next 24 hours

Update first. Sites on the 7.1 branch should be on 7.1.4; sites on 7.0 should be on 7.0.8; sites on 6.9 should be on 6.9.11, and each older branch has its own fixed release. WordPress notes that background updates will install the security release automatically on sites configured for them, but administrators should verify the version rather than assume.

Then reduce the attack surface. Hosts that control server configuration should block web access to wp-content/upgrade/ so the staging directory cannot be read during an update. That step does not replace patching, but it removes the condition that makes the race exploitable.

Finally, check for compromise. Review web server logs for requests to PHP files under wp-content/upgrade/, verify core file checksums, look for unexpected administrator accounts, and treat wp-config.php as a file to compare against a known-good copy. CISA has not attributed the exploitation or disclosed how many sites were affected, so the only reliable evidence is local.

What happens next

Expect scanning to increase before it decreases. Public KEV listings typically drive automated probing within hours, and the pool of unpatched sites is large enough to sustain it for weeks. Sites that patched on October 28 were ahead of the exploitation signal; sites that patch this week are behind it but still ahead of most automated campaigns.

The structural issue will outlast this CVE. WordPress 7.1.4 fixed 22 vulnerabilities across 17 advisories, according to Patchstack, and this is the fourth WordPress core entry in the KEV catalog this year. The pattern suggests that core update mechanics, not just individual features, deserve continuous scrutiny, and that automatic updates are only a safety net when someone verifies they ran.

For small businesses, the cost is mostly time. A compromised WordPress site can be used to host phishing pages, redirect visitors or seed malware, and cleanup usually means restoring from a backup that may predate the intrusion. Owners who do not manage their own hosting should ask the provider two questions this week: which core version is running, and whether the upgrade directory is blocked from the web. Those answers take minutes and cover the two conditions that make this flaw exploitable.

Frequently Asked Questions

What is CVE-2026-119977?

It is a race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026.

Which WordPress versions are affected?

Versions 4.7.0 through 7.1.3 are affected. The fix shipped in 7.1.4 on October 28, 2026, with backports to every supported branch down to 4.7.39. Versions 4.6 and earlier receive no fix.

Does updating to 7.1.4 fully protect my site?

Updating closes the vulnerability, and it is the required step. Administrators should also block web access to wp-content/upgrade/ and review logs for requests to PHP files in that directory during past updates, since exploitation before patching would not be visible from the version number alone.

Bottom line

The WordPress core vulnerability is a narrow bug with a wide blast radius: it needs a few seconds of timing and a reachable upgrade folder, and it hands over the server when it works. The fix has been available since October 28. CISA's November 3 listing confirms attackers found the sites that did not install it, and the only useful response now is to verify the version and inspect the logs.

Sources:
https://gbhackers.com/cisa-warns-of-wordpress-core-code-execution-vulnerability/
About US
WordPress Core Vulnerability Now Under Active Attack

A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, six days after WordPress shipped the fix in version 7.1.4. Any site still running an affected version should update today, and any site that updated recently should check its logs for signs of intrusion.

Key Takeaways:
- - CISA added CVE-2026-119977 to the KEV catalog on November 3, 2026, citing evidence of active exploitation.
- - The flaw affects WordPress core versions 4.7.0 through 7.1.3 and is fixed in 7.1.4, released October 28, 2026.
- - Exploitation requires no account, but it only works during the seconds-long window when a core update is unpacking.
- - Federal civilian agencies face a remediation deadline of November 6, 2026.
What CISA added and when

The November 3 alert is short and specific. CISA lists CVE-2026-119977 as a WordPress Core time-of-check time-of-use race condition vulnerability, added to the catalog based on evidence of active exploitation. The agency ties remediation requirements to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid fixes for catalog entries on internet-exposed assets that grant total control after exploitation.

The practical deadlines differ by audience. Federal agencies were given until November 6, 2026 to remediate, according to GBHackers. Private organizations face no legal deadline, but the KEV listing is the closest thing the US government publishes to a confirmed-attack signal, and CISA encourages all organizations to treat catalog entries as urgent.

How the flaw works

During a core update that uses a complete package, affected versions of WordPress unpack the new files into a predictable directory inside the web-served upgrade folder before replacing the live installation. An attacker who requests a file from that directory at the right moment, before the files are cleaned up, can get code executed by the server.

The GitHub security advisory describes it as a race condition and rates the practical window as brief. Two conditions make it exploitable: the site must be performing a full-package core update, and the upgrade directory must be reachable over the web. That combination is common on shared hosting and on sites that rely on automatic background updates, which is exactly how most WordPress installations are maintained.

Why the ratings disagree

Severity scores for this bug range widely, and the gap is worth understanding because it shapes how urgently different teams respond. Wordfence, acting as the CVE numbering authority, scored CVE-2026-119977 at 8.1, or high, on the CVSS 3.1 scale. WordPress' own security team treats the upgrade-process issue as low severity, and the GitHub advisory labels it low.

Both ratings can be correct at once. The CVSS score measures impact if exploited, which is total: code execution means full loss of confidentiality, integrity and availability for the site and often for anything sharing its database. The low rating reflects difficulty, since the attacker has to win a race measured in seconds and cannot trigger the update directly on demand. CISA's KEV listing resolves the argument in favor of treating it as urgent, because exploitation has now been observed rather than theorized.

Who is exposed

Versions 4.7.0 through 7.1.3 carry the flaw. WordPress shipped fixes on October 28, 2026 for every supported branch, from 7.1.4 down to 4.7.39, and sites running 4.6 or earlier will never receive a patch because those branches are out of support.

The exposure profile is broader than a single website. Agencies and hosts that manage many installations, including marketing sites, regional microsites and campaign pages, often run older core versions because nobody owns them. Those are the sites most likely to sit unpatched past the KEV deadline, and they are also the sites least likely to have logging that would reveal an intrusion.

What to do in the next 24 hours

Update first. Sites on the 7.1 branch should be on 7.1.4; sites on 7.0 should be on 7.0.8; sites on 6.9 should be on 6.9.11, and each older branch has its own fixed release. WordPress notes that background updates will install the security release automatically on sites configured for them, but administrators should verify the version rather than assume.

Then reduce the attack surface. Hosts that control server configuration should block web access to wp-content/upgrade/ so the staging directory cannot be read during an update. That step does not replace patching, but it removes the condition that makes the race exploitable.

Finally, check for compromise. Review web server logs for requests to PHP files under wp-content/upgrade/, verify core file checksums, look for unexpected administrator accounts, and treat wp-config.php as a file to compare against a known-good copy. CISA has not attributed the exploitation or disclosed how many sites were affected, so the only reliable evidence is local.

What happens next

Expect scanning to increase before it decreases. Public KEV listings typically drive automated probing within hours, and the pool of unpatched sites is large enough to sustain it for weeks. Sites that patched on October 28 were ahead of the exploitation signal; sites that patch this week are behind it but still ahead of most automated campaigns.

The structural issue will outlast this CVE. WordPress 7.1.4 fixed 22 vulnerabilities across 17 advisories, according to Patchstack, and this is the fourth WordPress core entry in the KEV catalog this year. The pattern suggests that core update mechanics, not just individual features, deserve continuous scrutiny, and that automatic updates are only a safety net when someone verifies they ran.

For small businesses, the cost is mostly time. A compromised WordPress site can be used to host phishing pages, redirect visitors or seed malware, and cleanup usually means restoring from a backup that may predate the intrusion. Owners who do not manage their own hosting should ask the provider two questions this week: which core version is running, and whether the upgrade directory is blocked from the web. Those answers take minutes and cover the two conditions that make this flaw exploitable.

Frequently Asked Questions

What is CVE-2026-119977?

It is a race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026.

Which WordPress versions are affected?

Versions 4.7.0 through 7.1.3 are affected. The fix shipped in 7.1.4 on October 28, 2026, with backports to every supported branch down to 4.7.39. Versions 4.6 and earlier receive no fix.

Does updating to 7.1.4 fully protect my site?

Updating closes the vulnerability, and it is the required step. Administrators should also block web access to wp-content/upgrade/ and review logs for requests to PHP files in that directory during past updates, since exploitation before patching would not be visible from the version number alone.

Bottom line

The WordPress core vulnerability is a narrow bug with a wide blast radius: it needs a few seconds of timing and a reachable upgrade folder, and it hands over the server when it works. The fix has been available since October 28. CISA's November 3 listing confirms attackers found the sites that did not install it, and the only useful response now is to verify the version and inspect the logs.

Sources:
https://gbhackers.com/cisa-warns-of-wordpress-core-code-execution-vulnerability/
Tech Reviews
WordPress Core Vulnerability Now Under Active Attack

A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, six days after WordPress shipped the fix in version 7.1.4. Any site still running an affected version should update today, and any site that updated recently should check its logs for signs of intrusion.

Key Takeaways:
- - CISA added CVE-2026-119977 to the KEV catalog on November 3, 2026, citing evidence of active exploitation.
- - The flaw affects WordPress core versions 4.7.0 through 7.1.3 and is fixed in 7.1.4, released October 28, 2026.
- - Exploitation requires no account, but it only works during the seconds-long window when a core update is unpacking.
- - Federal civilian agencies face a remediation deadline of November 6, 2026.
What CISA added and when

The November 3 alert is short and specific. CISA lists CVE-2026-119977 as a WordPress Core time-of-check time-of-use race condition vulnerability, added to the catalog based on evidence of active exploitation. The agency ties remediation requirements to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid fixes for catalog entries on internet-exposed assets that grant total control after exploitation.

The practical deadlines differ by audience. Federal agencies were given until November 6, 2026 to remediate, according to GBHackers. Private organizations face no legal deadline, but the KEV listing is the closest thing the US government publishes to a confirmed-attack signal, and CISA encourages all organizations to treat catalog entries as urgent.

How the flaw works

During a core update that uses a complete package, affected versions of WordPress unpack the new files into a predictable directory inside the web-served upgrade folder before replacing the live installation. An attacker who requests a file from that directory at the right moment, before the files are cleaned up, can get code executed by the server.

The GitHub security advisory describes it as a race condition and rates the practical window as brief. Two conditions make it exploitable: the site must be performing a full-package core update, and the upgrade directory must be reachable over the web. That combination is common on shared hosting and on sites that rely on automatic background updates, which is exactly how most WordPress installations are maintained.

Why the ratings disagree

Severity scores for this bug range widely, and the gap is worth understanding because it shapes how urgently different teams respond. Wordfence, acting as the CVE numbering authority, scored CVE-2026-119977 at 8.1, or high, on the CVSS 3.1 scale. WordPress' own security team treats the upgrade-process issue as low severity, and the GitHub advisory labels it low.

Both ratings can be correct at once. The CVSS score measures impact if exploited, which is total: code execution means full loss of confidentiality, integrity and availability for the site and often for anything sharing its database. The low rating reflects difficulty, since the attacker has to win a race measured in seconds and cannot trigger the update directly on demand. CISA's KEV listing resolves the argument in favor of treating it as urgent, because exploitation has now been observed rather than theorized.

Who is exposed

Versions 4.7.0 through 7.1.3 carry the flaw. WordPress shipped fixes on October 28, 2026 for every supported branch, from 7.1.4 down to 4.7.39, and sites running 4.6 or earlier will never receive a patch because those branches are out of support.

The exposure profile is broader than a single website. Agencies and hosts that manage many installations, including marketing sites, regional microsites and campaign pages, often run older core versions because nobody owns them. Those are the sites most likely to sit unpatched past the KEV deadline, and they are also the sites least likely to have logging that would reveal an intrusion.

What to do in the next 24 hours

Update first. Sites on the 7.1 branch should be on 7.1.4; sites on 7.0 should be on 7.0.8; sites on 6.9 should be on 6.9.11, and each older branch has its own fixed release. WordPress notes that background updates will install the security release automatically on sites configured for them, but administrators should verify the version rather than assume.

Then reduce the attack surface. Hosts that control server configuration should block web access to wp-content/upgrade/ so the staging directory cannot be read during an update. That step does not replace patching, but it removes the condition that makes the race exploitable.

Finally, check for compromise. Review web server logs for requests to PHP files under wp-content/upgrade/, verify core file checksums, look for unexpected administrator accounts, and treat wp-config.php as a file to compare against a known-good copy. CISA has not attributed the exploitation or disclosed how many sites were affected, so the only reliable evidence is local.

What happens next

Expect scanning to increase before it decreases. Public KEV listings typically drive automated probing within hours, and the pool of unpatched sites is large enough to sustain it for weeks. Sites that patched on October 28 were ahead of the exploitation signal; sites that patch this week are behind it but still ahead of most automated campaigns.

The structural issue will outlast this CVE. WordPress 7.1.4 fixed 22 vulnerabilities across 17 advisories, according to Patchstack, and this is the fourth WordPress core entry in the KEV catalog this year. The pattern suggests that core update mechanics, not just individual features, deserve continuous scrutiny, and that automatic updates are only a safety net when someone verifies they ran.

For small businesses, the cost is mostly time. A compromised WordPress site can be used to host phishing pages, redirect visitors or seed malware, and cleanup usually means restoring from a backup that may predate the intrusion. Owners who do not manage their own hosting should ask the provider two questions this week: which core version is running, and whether the upgrade directory is blocked from the web. Those answers take minutes and cover the two conditions that make this flaw exploitable.

Frequently Asked Questions

What is CVE-2026-119977?

It is a race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026.

Which WordPress versions are affected?

Versions 4.7.0 through 7.1.3 are affected. The fix shipped in 7.1.4 on October 28, 2026, with backports to every supported branch down to 4.7.39. Versions 4.6 and earlier receive no fix.

Does updating to 7.1.4 fully protect my site?

Updating closes the vulnerability, and it is the required step. Administrators should also block web access to wp-content/upgrade/ and review logs for requests to PHP files in that directory during past updates, since exploitation before patching would not be visible from the version number alone.

Bottom line

The WordPress core vulnerability is a narrow bug with a wide blast radius: it needs a few seconds of timing and a reachable upgrade folder, and it hands over the server when it works. The fix has been available since October 28. CISA's November 3 listing confirms attackers found the sites that did not install it, and the only useful response now is to verify the version and inspect the logs.

Sources:
https://gbhackers.com/cisa-warns-of-wordpress-core-code-execution-vulnerability/
- AI
- Troubleshooting
- Smartwatches
- Smartphones
- Camera
- Gadgets
- Games
- Laptops
- Seasonal Sales
Phone Features
WordPress Core Vulnerability Now Under Active Attack

A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, six days after WordPress shipped the fix in version 7.1.4. Any site still running an affected version should update today, and any site that updated recently should check its logs for signs of intrusion.

Key Takeaways:
- - CISA added CVE-2026-119977 to the KEV catalog on November 3, 2026, citing evidence of active exploitation.
- - The flaw affects WordPress core versions 4.7.0 through 7.1.3 and is fixed in 7.1.4, released October 28, 2026.
- - Exploitation requires no account, but it only works during the seconds-long window when a core update is unpacking.
- - Federal civilian agencies face a remediation deadline of November 6, 2026.
What CISA added and when

The November 3 alert is short and specific. CISA lists CVE-2026-119977 as a WordPress Core time-of-check time-of-use race condition vulnerability, added to the catalog based on evidence of active exploitation. The agency ties remediation requirements to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid fixes for catalog entries on internet-exposed assets that grant total control after exploitation.

The practical deadlines differ by audience. Federal agencies were given until November 6, 2026 to remediate, according to GBHackers. Private organizations face no legal deadline, but the KEV listing is the closest thing the US government publishes to a confirmed-attack signal, and CISA encourages all organizations to treat catalog entries as urgent.

How the flaw works

During a core update that uses a complete package, affected versions of WordPress unpack the new files into a predictable directory inside the web-served upgrade folder before replacing the live installation. An attacker who requests a file from that directory at the right moment, before the files are cleaned up, can get code executed by the server.

The GitHub security advisory describes it as a race condition and rates the practical window as brief. Two conditions make it exploitable: the site must be performing a full-package core update, and the upgrade directory must be reachable over the web. That combination is common on shared hosting and on sites that rely on automatic background updates, which is exactly how most WordPress installations are maintained.

Why the ratings disagree

Severity scores for this bug range widely, and the gap is worth understanding because it shapes how urgently different teams respond. Wordfence, acting as the CVE numbering authority, scored CVE-2026-119977 at 8.1, or high, on the CVSS 3.1 scale. WordPress' own security team treats the upgrade-process issue as low severity, and the GitHub advisory labels it low.

Both ratings can be correct at once. The CVSS score measures impact if exploited, which is total: code execution means full loss of confidentiality, integrity and availability for the site and often for anything sharing its database. The low rating reflects difficulty, since the attacker has to win a race measured in seconds and cannot trigger the update directly on demand. CISA's KEV listing resolves the argument in favor of treating it as urgent, because exploitation has now been observed rather than theorized.

Who is exposed

Versions 4.7.0 through 7.1.3 carry the flaw. WordPress shipped fixes on October 28, 2026 for every supported branch, from 7.1.4 down to 4.7.39, and sites running 4.6 or earlier will never receive a patch because those branches are out of support.

The exposure profile is broader than a single website. Agencies and hosts that manage many installations, including marketing sites, regional microsites and campaign pages, often run older core versions because nobody owns them. Those are the sites most likely to sit unpatched past the KEV deadline, and they are also the sites least likely to have logging that would reveal an intrusion.

What to do in the next 24 hours

Update first. Sites on the 7.1 branch should be on 7.1.4; sites on 7.0 should be on 7.0.8; sites on 6.9 should be on 6.9.11, and each older branch has its own fixed release. WordPress notes that background updates will install the security release automatically on sites configured for them, but administrators should verify the version rather than assume.

Then reduce the attack surface. Hosts that control server configuration should block web access to wp-content/upgrade/ so the staging directory cannot be read during an update. That step does not replace patching, but it removes the condition that makes the race exploitable.

Finally, check for compromise. Review web server logs for requests to PHP files under wp-content/upgrade/, verify core file checksums, look for unexpected administrator accounts, and treat wp-config.php as a file to compare against a known-good copy. CISA has not attributed the exploitation or disclosed how many sites were affected, so the only reliable evidence is local.

What happens next

Expect scanning to increase before it decreases. Public KEV listings typically drive automated probing within hours, and the pool of unpatched sites is large enough to sustain it for weeks. Sites that patched on October 28 were ahead of the exploitation signal; sites that patch this week are behind it but still ahead of most automated campaigns.

The structural issue will outlast this CVE. WordPress 7.1.4 fixed 22 vulnerabilities across 17 advisories, according to Patchstack, and this is the fourth WordPress core entry in the KEV catalog this year. The pattern suggests that core update mechanics, not just individual features, deserve continuous scrutiny, and that automatic updates are only a safety net when someone verifies they ran.

For small businesses, the cost is mostly time. A compromised WordPress site can be used to host phishing pages, redirect visitors or seed malware, and cleanup usually means restoring from a backup that may predate the intrusion. Owners who do not manage their own hosting should ask the provider two questions this week: which core version is running, and whether the upgrade directory is blocked from the web. Those answers take minutes and cover the two conditions that make this flaw exploitable.

Frequently Asked Questions

What is CVE-2026-119977?

It is a race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026.

Which WordPress versions are affected?

Versions 4.7.0 through 7.1.3 are affected. The fix shipped in 7.1.4 on October 28, 2026, with backports to every supported branch down to 4.7.39. Versions 4.6 and earlier receive no fix.

Does updating to 7.1.4 fully protect my site?

Updating closes the vulnerability, and it is the required step. Administrators should also block web access to wp-content/upgrade/ and review logs for requests to PHP files in that directory during past updates, since exploitation before patching would not be visible from the version number alone.

Bottom line

The WordPress core vulnerability is a narrow bug with a wide blast radius: it needs a few seconds of timing and a reachable upgrade folder, and it hands over the server when it works. The fix has been available since October 28. CISA's November 3 listing confirms attackers found the sites that did not install it, and the only useful response now is to verify the version and inspect the logs.

Sources:
https://gbhackers.com/cisa-warns-of-wordpress-core-code-execution-vulnerability/
Buying Guides
WordPress Core Vulnerability Now Under Active Attack

A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, six days after WordPress shipped the fix in version 7.1.4. Any site still running an affected version should update today, and any site that updated recently should check its logs for signs of intrusion.

Key Takeaways:
- - CISA added CVE-2026-119977 to the KEV catalog on November 3, 2026, citing evidence of active exploitation.
- - The flaw affects WordPress core versions 4.7.0 through 7.1.3 and is fixed in 7.1.4, released October 28, 2026.
- - Exploitation requires no account, but it only works during the seconds-long window when a core update is unpacking.
- - Federal civilian agencies face a remediation deadline of November 6, 2026.
What CISA added and when

The November 3 alert is short and specific. CISA lists CVE-2026-119977 as a WordPress Core time-of-check time-of-use race condition vulnerability, added to the catalog based on evidence of active exploitation. The agency ties remediation requirements to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid fixes for catalog entries on internet-exposed assets that grant total control after exploitation.

The practical deadlines differ by audience. Federal agencies were given until November 6, 2026 to remediate, according to GBHackers. Private organizations face no legal deadline, but the KEV listing is the closest thing the US government publishes to a confirmed-attack signal, and CISA encourages all organizations to treat catalog entries as urgent.

How the flaw works

During a core update that uses a complete package, affected versions of WordPress unpack the new files into a predictable directory inside the web-served upgrade folder before replacing the live installation. An attacker who requests a file from that directory at the right moment, before the files are cleaned up, can get code executed by the server.

The GitHub security advisory describes it as a race condition and rates the practical window as brief. Two conditions make it exploitable: the site must be performing a full-package core update, and the upgrade directory must be reachable over the web. That combination is common on shared hosting and on sites that rely on automatic background updates, which is exactly how most WordPress installations are maintained.

Why the ratings disagree

Severity scores for this bug range widely, and the gap is worth understanding because it shapes how urgently different teams respond. Wordfence, acting as the CVE numbering authority, scored CVE-2026-119977 at 8.1, or high, on the CVSS 3.1 scale. WordPress' own security team treats the upgrade-process issue as low severity, and the GitHub advisory labels it low.

Both ratings can be correct at once. The CVSS score measures impact if exploited, which is total: code execution means full loss of confidentiality, integrity and availability for the site and often for anything sharing its database. The low rating reflects difficulty, since the attacker has to win a race measured in seconds and cannot trigger the update directly on demand. CISA's KEV listing resolves the argument in favor of treating it as urgent, because exploitation has now been observed rather than theorized.

Who is exposed

Versions 4.7.0 through 7.1.3 carry the flaw. WordPress shipped fixes on October 28, 2026 for every supported branch, from 7.1.4 down to 4.7.39, and sites running 4.6 or earlier will never receive a patch because those branches are out of support.

The exposure profile is broader than a single website. Agencies and hosts that manage many installations, including marketing sites, regional microsites and campaign pages, often run older core versions because nobody owns them. Those are the sites most likely to sit unpatched past the KEV deadline, and they are also the sites least likely to have logging that would reveal an intrusion.

What to do in the next 24 hours

Update first. Sites on the 7.1 branch should be on 7.1.4; sites on 7.0 should be on 7.0.8; sites on 6.9 should be on 6.9.11, and each older branch has its own fixed release. WordPress notes that background updates will install the security release automatically on sites configured for them, but administrators should verify the version rather than assume.

Then reduce the attack surface. Hosts that control server configuration should block web access to wp-content/upgrade/ so the staging directory cannot be read during an update. That step does not replace patching, but it removes the condition that makes the race exploitable.

Finally, check for compromise. Review web server logs for requests to PHP files under wp-content/upgrade/, verify core file checksums, look for unexpected administrator accounts, and treat wp-config.php as a file to compare against a known-good copy. CISA has not attributed the exploitation or disclosed how many sites were affected, so the only reliable evidence is local.

What happens next

Expect scanning to increase before it decreases. Public KEV listings typically drive automated probing within hours, and the pool of unpatched sites is large enough to sustain it for weeks. Sites that patched on October 28 were ahead of the exploitation signal; sites that patch this week are behind it but still ahead of most automated campaigns.

The structural issue will outlast this CVE. WordPress 7.1.4 fixed 22 vulnerabilities across 17 advisories, according to Patchstack, and this is the fourth WordPress core entry in the KEV catalog this year. The pattern suggests that core update mechanics, not just individual features, deserve continuous scrutiny, and that automatic updates are only a safety net when someone verifies they ran.

For small businesses, the cost is mostly time. A compromised WordPress site can be used to host phishing pages, redirect visitors or seed malware, and cleanup usually means restoring from a backup that may predate the intrusion. Owners who do not manage their own hosting should ask the provider two questions this week: which core version is running, and whether the upgrade directory is blocked from the web. Those answers take minutes and cover the two conditions that make this flaw exploitable.

Frequently Asked Questions

What is CVE-2026-119977?

It is a race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026.

Which WordPress versions are affected?

Versions 4.7.0 through 7.1.3 are affected. The fix shipped in 7.1.4 on October 28, 2026, with backports to every supported branch down to 4.7.39. Versions 4.6 and earlier receive no fix.

Does updating to 7.1.4 fully protect my site?

Updating closes the vulnerability, and it is the required step. Administrators should also block web access to wp-content/upgrade/ and review logs for requests to PHP files in that directory during past updates, since exploitation before patching would not be visible from the version number alone.

Bottom line

The WordPress core vulnerability is a narrow bug with a wide blast radius: it needs a few seconds of timing and a reachable upgrade folder, and it hands over the server when it works. The fix has been available since October 28. CISA's November 3 listing confirms attackers found the sites that did not install it, and the only useful response now is to verify the version and inspect the logs.

Sources:
https://gbhackers.com/cisa-warns-of-wordpress-core-code-execution-vulnerability/
Comparison
WordPress Core Vulnerability Now Under Active Attack

A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, six days after WordPress shipped the fix in version 7.1.4. Any site still running an affected version should update today, and any site that updated recently should check its logs for signs of intrusion.

Key Takeaways:
- - CISA added CVE-2026-119977 to the KEV catalog on November 3, 2026, citing evidence of active exploitation.
- - The flaw affects WordPress core versions 4.7.0 through 7.1.3 and is fixed in 7.1.4, released October 28, 2026.
- - Exploitation requires no account, but it only works during the seconds-long window when a core update is unpacking.
- - Federal civilian agencies face a remediation deadline of November 6, 2026.
What CISA added and when

The November 3 alert is short and specific. CISA lists CVE-2026-119977 as a WordPress Core time-of-check time-of-use race condition vulnerability, added to the catalog based on evidence of active exploitation. The agency ties remediation requirements to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid fixes for catalog entries on internet-exposed assets that grant total control after exploitation.

The practical deadlines differ by audience. Federal agencies were given until November 6, 2026 to remediate, according to GBHackers. Private organizations face no legal deadline, but the KEV listing is the closest thing the US government publishes to a confirmed-attack signal, and CISA encourages all organizations to treat catalog entries as urgent.

How the flaw works

During a core update that uses a complete package, affected versions of WordPress unpack the new files into a predictable directory inside the web-served upgrade folder before replacing the live installation. An attacker who requests a file from that directory at the right moment, before the files are cleaned up, can get code executed by the server.

The GitHub security advisory describes it as a race condition and rates the practical window as brief. Two conditions make it exploitable: the site must be performing a full-package core update, and the upgrade directory must be reachable over the web. That combination is common on shared hosting and on sites that rely on automatic background updates, which is exactly how most WordPress installations are maintained.

Why the ratings disagree

Severity scores for this bug range widely, and the gap is worth understanding because it shapes how urgently different teams respond. Wordfence, acting as the CVE numbering authority, scored CVE-2026-119977 at 8.1, or high, on the CVSS 3.1 scale. WordPress' own security team treats the upgrade-process issue as low severity, and the GitHub advisory labels it low.

Both ratings can be correct at once. The CVSS score measures impact if exploited, which is total: code execution means full loss of confidentiality, integrity and availability for the site and often for anything sharing its database. The low rating reflects difficulty, since the attacker has to win a race measured in seconds and cannot trigger the update directly on demand. CISA's KEV listing resolves the argument in favor of treating it as urgent, because exploitation has now been observed rather than theorized.

Who is exposed

Versions 4.7.0 through 7.1.3 carry the flaw. WordPress shipped fixes on October 28, 2026 for every supported branch, from 7.1.4 down to 4.7.39, and sites running 4.6 or earlier will never receive a patch because those branches are out of support.

The exposure profile is broader than a single website. Agencies and hosts that manage many installations, including marketing sites, regional microsites and campaign pages, often run older core versions because nobody owns them. Those are the sites most likely to sit unpatched past the KEV deadline, and they are also the sites least likely to have logging that would reveal an intrusion.

What to do in the next 24 hours

Update first. Sites on the 7.1 branch should be on 7.1.4; sites on 7.0 should be on 7.0.8; sites on 6.9 should be on 6.9.11, and each older branch has its own fixed release. WordPress notes that background updates will install the security release automatically on sites configured for them, but administrators should verify the version rather than assume.

Then reduce the attack surface. Hosts that control server configuration should block web access to wp-content/upgrade/ so the staging directory cannot be read during an update. That step does not replace patching, but it removes the condition that makes the race exploitable.

Finally, check for compromise. Review web server logs for requests to PHP files under wp-content/upgrade/, verify core file checksums, look for unexpected administrator accounts, and treat wp-config.php as a file to compare against a known-good copy. CISA has not attributed the exploitation or disclosed how many sites were affected, so the only reliable evidence is local.

What happens next

Expect scanning to increase before it decreases. Public KEV listings typically drive automated probing within hours, and the pool of unpatched sites is large enough to sustain it for weeks. Sites that patched on October 28 were ahead of the exploitation signal; sites that patch this week are behind it but still ahead of most automated campaigns.

The structural issue will outlast this CVE. WordPress 7.1.4 fixed 22 vulnerabilities across 17 advisories, according to Patchstack, and this is the fourth WordPress core entry in the KEV catalog this year. The pattern suggests that core update mechanics, not just individual features, deserve continuous scrutiny, and that automatic updates are only a safety net when someone verifies they ran.

For small businesses, the cost is mostly time. A compromised WordPress site can be used to host phishing pages, redirect visitors or seed malware, and cleanup usually means restoring from a backup that may predate the intrusion. Owners who do not manage their own hosting should ask the provider two questions this week: which core version is running, and whether the upgrade directory is blocked from the web. Those answers take minutes and cover the two conditions that make this flaw exploitable.

Frequently Asked Questions

What is CVE-2026-119977?

It is a race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026.

Which WordPress versions are affected?

Versions 4.7.0 through 7.1.3 are affected. The fix shipped in 7.1.4 on October 28, 2026, with backports to every supported branch down to 4.7.39. Versions 4.6 and earlier receive no fix.

Does updating to 7.1.4 fully protect my site?

Updating closes the vulnerability, and it is the required step. Administrators should also block web access to wp-content/upgrade/ and review logs for requests to PHP files in that directory during past updates, since exploitation before patching would not be visible from the version number alone.

Bottom line

The WordPress core vulnerability is a narrow bug with a wide blast radius: it needs a few seconds of timing and a reachable upgrade folder, and it hands over the server when it works. The fix has been available since October 28. CISA's November 3 listing confirms attackers found the sites that did not install it, and the only useful response now is to verify the version and inspect the logs.

Sources:
https://gbhackers.com/cisa-warns-of-wordpress-core-code-execution-vulnerability/
News
WordPress Core Vulnerability Now Under Active Attack

A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, six days after WordPress shipped the fix in version 7.1.4. Any site still running an affected version should update today, and any site that updated recently should check its logs for signs of intrusion.

Key Takeaways:
- - CISA added CVE-2026-119977 to the KEV catalog on November 3, 2026, citing evidence of active exploitation.
- - The flaw affects WordPress core versions 4.7.0 through 7.1.3 and is fixed in 7.1.4, released October 28, 2026.
- - Exploitation requires no account, but it only works during the seconds-long window when a core update is unpacking.
- - Federal civilian agencies face a remediation deadline of November 6, 2026.
What CISA added and when

The November 3 alert is short and specific. CISA lists CVE-2026-119977 as a WordPress Core time-of-check time-of-use race condition vulnerability, added to the catalog based on evidence of active exploitation. The agency ties remediation requirements to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid fixes for catalog entries on internet-exposed assets that grant total control after exploitation.

The practical deadlines differ by audience. Federal agencies were given until November 6, 2026 to remediate, according to GBHackers. Private organizations face no legal deadline, but the KEV listing is the closest thing the US government publishes to a confirmed-attack signal, and CISA encourages all organizations to treat catalog entries as urgent.

How the flaw works

During a core update that uses a complete package, affected versions of WordPress unpack the new files into a predictable directory inside the web-served upgrade folder before replacing the live installation. An attacker who requests a file from that directory at the right moment, before the files are cleaned up, can get code executed by the server.

The GitHub security advisory describes it as a race condition and rates the practical window as brief. Two conditions make it exploitable: the site must be performing a full-package core update, and the upgrade directory must be reachable over the web. That combination is common on shared hosting and on sites that rely on automatic background updates, which is exactly how most WordPress installations are maintained.

Why the ratings disagree

Severity scores for this bug range widely, and the gap is worth understanding because it shapes how urgently different teams respond. Wordfence, acting as the CVE numbering authority, scored CVE-2026-119977 at 8.1, or high, on the CVSS 3.1 scale. WordPress' own security team treats the upgrade-process issue as low severity, and the GitHub advisory labels it low.

Both ratings can be correct at once. The CVSS score measures impact if exploited, which is total: code execution means full loss of confidentiality, integrity and availability for the site and often for anything sharing its database. The low rating reflects difficulty, since the attacker has to win a race measured in seconds and cannot trigger the update directly on demand. CISA's KEV listing resolves the argument in favor of treating it as urgent, because exploitation has now been observed rather than theorized.

Who is exposed

Versions 4.7.0 through 7.1.3 carry the flaw. WordPress shipped fixes on October 28, 2026 for every supported branch, from 7.1.4 down to 4.7.39, and sites running 4.6 or earlier will never receive a patch because those branches are out of support.

The exposure profile is broader than a single website. Agencies and hosts that manage many installations, including marketing sites, regional microsites and campaign pages, often run older core versions because nobody owns them. Those are the sites most likely to sit unpatched past the KEV deadline, and they are also the sites least likely to have logging that would reveal an intrusion.

What to do in the next 24 hours

Update first. Sites on the 7.1 branch should be on 7.1.4; sites on 7.0 should be on 7.0.8; sites on 6.9 should be on 6.9.11, and each older branch has its own fixed release. WordPress notes that background updates will install the security release automatically on sites configured for them, but administrators should verify the version rather than assume.

Then reduce the attack surface. Hosts that control server configuration should block web access to wp-content/upgrade/ so the staging directory cannot be read during an update. That step does not replace patching, but it removes the condition that makes the race exploitable.

Finally, check for compromise. Review web server logs for requests to PHP files under wp-content/upgrade/, verify core file checksums, look for unexpected administrator accounts, and treat wp-config.php as a file to compare against a known-good copy. CISA has not attributed the exploitation or disclosed how many sites were affected, so the only reliable evidence is local.

What happens next

Expect scanning to increase before it decreases. Public KEV listings typically drive automated probing within hours, and the pool of unpatched sites is large enough to sustain it for weeks. Sites that patched on October 28 were ahead of the exploitation signal; sites that patch this week are behind it but still ahead of most automated campaigns.

The structural issue will outlast this CVE. WordPress 7.1.4 fixed 22 vulnerabilities across 17 advisories, according to Patchstack, and this is the fourth WordPress core entry in the KEV catalog this year. The pattern suggests that core update mechanics, not just individual features, deserve continuous scrutiny, and that automatic updates are only a safety net when someone verifies they ran.

For small businesses, the cost is mostly time. A compromised WordPress site can be used to host phishing pages, redirect visitors or seed malware, and cleanup usually means restoring from a backup that may predate the intrusion. Owners who do not manage their own hosting should ask the provider two questions this week: which core version is running, and whether the upgrade directory is blocked from the web. Those answers take minutes and cover the two conditions that make this flaw exploitable.

Frequently Asked Questions

What is CVE-2026-119977?

It is a race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026.

Which WordPress versions are affected?

Versions 4.7.0 through 7.1.3 are affected. The fix shipped in 7.1.4 on October 28, 2026, with backports to every supported branch down to 4.7.39. Versions 4.6 and earlier receive no fix.

Does updating to 7.1.4 fully protect my site?

Updating closes the vulnerability, and it is the required step. Administrators should also block web access to wp-content/upgrade/ and review logs for requests to PHP files in that directory during past updates, since exploitation before patching would not be visible from the version number alone.

Bottom line

The WordPress core vulnerability is a narrow bug with a wide blast radius: it needs a few seconds of timing and a reachable upgrade folder, and it hands over the server when it works. The fix has been available since October 28. CISA's November 3 listing confirms attackers found the sites that did not install it, and the only useful response now is to verify the version and inspect the logs.

Sources:
https://gbhackers.com/cisa-warns-of-wordpress-core-code-execution-vulnerability/
Contact
WordPress Core Vulnerability Now Under Active Attack

A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as exploited in the wild. CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog on November 3, 2026, six days after WordPress shipped the fix in version 7.1.4. Any site still running an affected version should update today, and any site that updated recently should check its logs for signs of intrusion.

Key Takeaways:
- - CISA added CVE-2026-119977 to the KEV catalog on November 3, 2026, citing evidence of active exploitation.
- - The flaw affects WordPress core versions 4.7.0 through 7.1.3 and is fixed in 7.1.4, released October 28, 2026.
- - Exploitation requires no account, but it only works during the seconds-long window when a core update is unpacking.
- - Federal civilian agencies face a remediation deadline of November 6, 2026.
What CISA added and when

The November 3 alert is short and specific. CISA lists CVE-2026-119977 as a WordPress Core time-of-check time-of-use race condition vulnerability, added to the catalog based on evidence of active exploitation. The agency ties remediation requirements to Binding Operational Directive 26-04, which requires federal civilian agencies to prioritize rapid fixes for catalog entries on internet-exposed assets that grant total control after exploitation.

The practical deadlines differ by audience. Federal agencies were given until November 6, 2026 to remediate, according to GBHackers. Private organizations face no legal deadline, but the KEV listing is the closest thing the US government publishes to a confirmed-attack signal, and CISA encourages all organizations to treat catalog entries as urgent.

How the flaw works

During a core update that uses a complete package, affected versions of WordPress unpack the new files into a predictable directory inside the web-served upgrade folder before replacing the live installation. An attacker who requests a file from that directory at the right moment, before the files are cleaned up, can get code executed by the server.

The GitHub security advisory describes it as a race condition and rates the practical window as brief. Two conditions make it exploitable: the site must be performing a full-package core update, and the upgrade directory must be reachable over the web. That combination is common on shared hosting and on sites that rely on automatic background updates, which is exactly how most WordPress installations are maintained.

Why the ratings disagree

Severity scores for this bug range widely, and the gap is worth understanding because it shapes how urgently different teams respond. Wordfence, acting as the CVE numbering authority, scored CVE-2026-119977 at 8.1, or high, on the CVSS 3.1 scale. WordPress' own security team treats the upgrade-process issue as low severity, and the GitHub advisory labels it low.

Both ratings can be correct at once. The CVSS score measures impact if exploited, which is total: code execution means full loss of confidentiality, integrity and availability for the site and often for anything sharing its database. The low rating reflects difficulty, since the attacker has to win a race measured in seconds and cannot trigger the update directly on demand. CISA's KEV listing resolves the argument in favor of treating it as urgent, because exploitation has now been observed rather than theorized.

Who is exposed

Versions 4.7.0 through 7.1.3 carry the flaw. WordPress shipped fixes on October 28, 2026 for every supported branch, from 7.1.4 down to 4.7.39, and sites running 4.6 or earlier will never receive a patch because those branches are out of support.

The exposure profile is broader than a single website. Agencies and hosts that manage many installations, including marketing sites, regional microsites and campaign pages, often run older core versions because nobody owns them. Those are the sites most likely to sit unpatched past the KEV deadline, and they are also the sites least likely to have logging that would reveal an intrusion.

What to do in the next 24 hours

Update first. Sites on the 7.1 branch should be on 7.1.4; sites on 7.0 should be on 7.0.8; sites on 6.9 should be on 6.9.11, and each older branch has its own fixed release. WordPress notes that background updates will install the security release automatically on sites configured for them, but administrators should verify the version rather than assume.

Then reduce the attack surface. Hosts that control server configuration should block web access to wp-content/upgrade/ so the staging directory cannot be read during an update. That step does not replace patching, but it removes the condition that makes the race exploitable.

Finally, check for compromise. Review web server logs for requests to PHP files under wp-content/upgrade/, verify core file checksums, look for unexpected administrator accounts, and treat wp-config.php as a file to compare against a known-good copy. CISA has not attributed the exploitation or disclosed how many sites were affected, so the only reliable evidence is local.

What happens next

Expect scanning to increase before it decreases. Public KEV listings typically drive automated probing within hours, and the pool of unpatched sites is large enough to sustain it for weeks. Sites that patched on October 28 were ahead of the exploitation signal; sites that patch this week are behind it but still ahead of most automated campaigns.

The structural issue will outlast this CVE. WordPress 7.1.4 fixed 22 vulnerabilities across 17 advisories, according to Patchstack, and this is the fourth WordPress core entry in the KEV catalog this year. The pattern suggests that core update mechanics, not just individual features, deserve continuous scrutiny, and that automatic updates are only a safety net when someone verifies they ran.

For small businesses, the cost is mostly time. A compromised WordPress site can be used to host phishing pages, redirect visitors or seed malware, and cleanup usually means restoring from a backup that may predate the intrusion. Owners who do not manage their own hosting should ask the provider two questions this week: which core version is running, and whether the upgrade directory is blocked from the web. Those answers take minutes and cover the two conditions that make this flaw exploitable.

Frequently Asked Questions

What is CVE-2026-119977?

It is a race condition in the WordPress core update process that can lead to remote code execution during the upgrade window. CISA added it to the Known Exploited Vulnerabilities catalog on November 3, 2026.

Which WordPress versions are affected?

Versions 4.7.0 through 7.1.3 are affected. The fix shipped in 7.1.4 on October 28, 2026, with backports to every supported branch down to 4.7.39. Versions 4.6 and earlier receive no fix.

Does updating to 7.1.4 fully protect my site?

Updating closes the vulnerability, and it is the required step. Administrators should also block web access to wp-content/upgrade/ and review logs for requests to PHP files in that directory during past updates, since exploitation before patching would not be visible from the version number alone.

Bottom line

The WordPress core vulnerability is a narrow bug with a wide blast radius: it needs a few seconds of timing and a reachable upgrade folder, and it hands over the server when it works. The fix has been available since October 28. CISA's November 3 listing confirms attackers found the sites that did not install it, and the only useful response now is to verify the version and inspect the logs.

Sources:
https://gbhackers.com/cisa-warns-of-wordpress-core-code-execution-vulnerability/

WordPress core vulnerability exploited

xthe
November 6, 2026
10 min read
1

WordPress Core Vulnerability Now Under Active Attack A WordPress core vulnerability that lets an unauthenticated attacker run code on a server is now confirmed as... Details

Pentagon drone loan: $450M to Neros

xthe
November 6, 2026
10 min read
2

Pentagon Drone Loan Sends $450M to Neros for US Parts The Pentagon drone loan announced November 2, 2026 commits up to $450 million to Neros,... Details

USCIS naturalization memo: new test

xthe
November 6, 2026
10 min read
2

USCIS Naturalization Memo Adds Scrutiny for N-400 Applicants A USCIS naturalization memo issued November 4, 2026 tells officers to look harder at whether applicants support... Details

Medicare drug premiums jump 50%

xthe
November 5, 2026
10 min read
2

Medicare Drug Premiums Climb 50% as Open Enrollment Runs Medicare drug premiums are set to rise sharply next year for people who stay in stand-alone... Details

Galaxy Ring sleep apnea arrives in US

xthe
November 5, 2026
10 min read
6

Galaxy Ring Sleep Apnea Detection Arrives in the US Samsung's Galaxy Ring can now screen for signs of sleep apnea in the United States. The... Details

Anthropic IPO filing: $17B quarter

xthe
November 5, 2026
10 min read
9

Anthropic IPO Filing: $17B Quarter, $895B Compute Bill The Anthropic IPO filing now has numbers in it. An amendment to the company's Form S-1, filed... Details

Binance Crypto Hack Hits $6.3B

xthe
November 3, 2026
10 min read
5

Binance Crypto Hack Drains $6.3 Billion, the Largest Theft on Record The Binance crypto hack confirmed on October 29, 2026 removed roughly $6.3 billion across... Details

AMRAAM Production Goes to Japan

xthe
November 3, 2026
10 min read
3

AMRAAM Production Japan Deal Adds a Second Allied Missile Factory AMRAAM production is expanding to Japan, under an agreement Defense Secretary Pete Hegseth and Japanese... Details

Diversity Visa Lottery Remains Paused

xthe
November 3, 2026
10 min read
3

Diversity Visa Lottery Stay Halts the November 1 Reopening The diversity visa lottery will not open for 2027 registration on November 1 as a lower... Details

Voceryq FDA Approval: First DNA Drug

xthe
November 2, 2026
10 min read
3

Voceryq FDA Approval Makes It the First DNA Medicine Sold in the US The FDA approved Voceryq on October 30, 2026 as the first plasmid... Details

Latest post

WordPress core vulnerability exploited

Pentagon drone loan: $450M to Neros

USCIS naturalization memo: new test

Popular Posts

DSLR vs Mirrorless: Which Is Better for Photography Beginners? (25424)

Best Budget Smartphones 2026: Affordable Phones That Impress (4240)

Best Business Laptops 2025 (4213)

The Future Is Calling: Top Upcoming Smartphones of 2026 You’ll Want to Wait For (3365)

NIST Update Signals Fast Track for Post-Quantum Standards (2408)

Stay Connected

Category: News

WordPress core vulnerability exploited

Pentagon drone loan: $450M to Neros

USCIS naturalization memo: new test

Medicare drug premiums jump 50%

Galaxy Ring sleep apnea arrives in US

Anthropic IPO filing: $17B quarter

Binance Crypto Hack Hits $6.3B

AMRAAM Production Goes to Japan

Diversity Visa Lottery Remains Paused

Voceryq FDA Approval: First DNA Drug

Quick Links