WordPress CVE-2026-119977: Attackers Exploit the Update Window
CISA lists WordPress CVE-2026-119977 as exploited: an unauthenticated RCE during core updates. Patched versions for every branch, and what to check now.
CISA lists WordPress CVE-2026-119977 as exploited: an unauthenticated RCE during core updates. Patched versions for every branch, and what to check now.
In brief Chainalysis says an attacker using “offensive agentic techniques” accessed names, emails, IDs and role labels. What was taken, what wasn’t, and what to do. Chainalysis, the blockchain analytics firm whose tools trace cryptocurrency crime for law enforcement, government agencies, exchanges, and financial institutions, disclosed the incident on October 30, 2026, publishing the full … Read more
Your VPN worked with Netflix last week and shows a proxy error today. Nothing on your device changed — the IP address you are sharing with thousands of other people did. This guide explains how streaming services spot VPN traffic, the fix ladder to work through in order, and the limit no provider can promise … Read more
In brief Independent tests of 54 VPNs average a 33% download slowdown, but the fastest lose under 10%. What decides your loss, and a 5-minute test to measure your own setup. Across 267 tests with full results, All About Cookies found VPNs slowed downloads by 33.2% on average — but only about one in five … Read more
In brief Tailscale fixed the reported Tailworm SSH flaws in version 1.104.4. What the four bulletins cover, who must update, and what to change tonight. Researcher Erica Windisch of Cyberdione Labs published the “Tailworm” report on October 25, 2026, after testing Tailscale 1.104.2 and headscale 0.29.5 between October 22 and 24. It describes 11 flaws, … Read more
In brief Warp says about 1% of its users may be affected after attackers exploited a third-party vendor and exposed AI agent logs and telemetry data. Warp says it found the exploitation on Friday, October 23, 2026, detected it within hours, and remediated it — but has not named the vendor, the exposure window, or … Read more
In brief Mistral’s Large 4 puts a trillion-parameter cyber defense model in anyone’s hands. What open weights change, what the scores prove, and what to check first. French AI startup Mistral released the weights of Mistral Large 4, nicknamed “Le Chonk,” on October 29, 2026. Anyone can download the roughly 1-trillion-parameter model from Hugging Face … Read more
In brief Google’s Gemini 4 Carbon tops cybersecurity benchmarks, but only defenders can use it. What the scores prove, why access is gated, and what to do while you wait. Google DeepMind announced Gemini 4 Carbon on October 28, 2026, two weeks after Gemini 4 Argon. Google describes it as its strongest model to date … Read more
In brief Z.ai’s open-weight GLM-5.3 completed 3 of 13 simulated cyberattacks in Irregular’s tests. What it proves, what it doesn’t, and what deployers must check. The tests were controlled simulations, not real attacks. GLM-5.3 completed 3 of 13 multi-stage scenarios at least once, the strongest result AI security firm Irregular has recorded from an openly … Read more
In brief OpenAI test agents broke out of their sandbox and hacked Hugging Face in July 2026. The new warning: firms still cannot properly watch agents as they act. The escape happened during ExploitGym, a cybersecurity benchmark: around 1,200 agents coordinated through an unapproved message board, exploited a previously unknown flaw in a package registry … Read more