Your WordPress site is most hackable while updating it

Good morning, and welcome to It's probably nothing for the edition dated 5 November 2026.

Busy one today. Two of the bigger stories are update infrastructure being turned against its owners: one in WordPress core itself, one at a security vendor. There are also two genuinely good research drops from Sekoia and ESET, and a local warning worth forwarding to the less technical people in your life.

CISA has put a WordPress core bug on the Known Exploited Vulnerabilities list, saying there's evidence of active exploitation. It's a time-of-check, time-of-use race in WordPress's own upgrade process: during a full-package upgrade, predictable, web-accessible staging paths can let an unauthenticated attacker run code on the server. The key caveat is timing. This is exploitable while a site is mid-upgrade, not a standing pre-auth remote code execution. But a huge chunk of the self-hosted web passed through that window recently, because the fix only landed on 28 October in WordPress 7.1.4, credited to reporter Umut Bayram alongside a pile of mostly stored XSS fixes. CISA has given US federal agencies until 6 November and says forensic triage is required, which is unusually brisk. Known ransomware campaign use is listed as unknown. Wordfence describes the affected range as 4.7.0 through 7.1.3, effectively the whole fleet, though its detail page returned a 403, so that range comes from the entry title rather than the full text. WordPress says backports are going to eligible branches down to 4.7 as they're ready, but only the latest version is actively supported. If you did a full-package upgrade before 7.1.4 landed, patch and look at what happened during the upgrade window. Beyond CISA saying exploitation is happening, there's no public attack detail, actor or victim count.

OpsShield says an attacker used compromised credentials to get into its update distribution CDN at 02:06 UTC on 2 November, then used the cPGuard update channel itself to push a malicious script to recent 5.88 builds. The script installed a backdoor and collected Linux password hashes, root MariaDB or MySQL configuration, root shell history and root SSH files, then exfiltrated it, with a certain poetry, through OpsShield's own licensing server using a compromised account. The vendor told BleepingComputer 2,946 servers were affected and had that data copied, and that its billing system database went too. OpsShield says it detected the compromise and stopped distribution within 12 hours, and some servers escaped because update checks run at intervals. How the credentials were obtained remains unclear. cPGuard is the sort of security suite hosting firms bolt onto cPanel, DirectAdmin and Plesk boxes, so root credential theft across thousands of shared-hosting servers has obvious second-order potential. The fixed release removes the backdoor and staged files, but the collected credentials are already gone: passwords, database creds, cloud secrets and SSH keys need rotating, not just patching over.

Sekoia has published a thorough autopsy of a watering-hole campaign it uncovered in mid-October, and the interesting part is the plumbing. Delivery came three ways: compromised legitimate sites, lookalike reverse-proxy domains for america250.org and Raffles London at The OWO, the hotel near Whitehall where open-source reporting says Zelensky stayed on 14 October, and a one-week trojanisation of Ukrainian analytics service Plerdy's tracker between 27 August and 3 September. That exposed hundreds to thousands of predominantly Ukrainian sites, including defence-sector and military-recruitment pages. Visitors on outdated iOS or Android got zero-click chains built entirely from known, patched vulnerabilities, no zero-days, including a full-device iOS 18.5 chain reusing the DarkSword commercial surveillance kit. Payloads stole browser cookies and, in some cases, message stores, keychain items and Wi-Fi passwords, with no persistence installed. Stolen session cookies mean webmail access without a password. Sekoia assesses APT29, the SVR, with moderate-to-high confidence based on technical overlaps and victimology; Google TAG confirmed the framework resembles APT29's 2024 Mongolian watering-hole work and that the exploits match commercial surveillance vendor tooling. Fully updated devices were never at risk. This one punished the unpatched.

ESET has detailed a DNS hijacking operation by SlippyNunchucks, the China-aligned group behind the DarkVigil toolset. Since 1 July, whoever controlled DNS resolution for Sogou's config domain could answer the Sogou Input Method's unencrypted HTTP brand-promotion requests with a malicious configuration, telling the legitimate SGTool.exe to fetch a signed Adobe binary and a malicious libcef DLL, then plant them where Sogou's own component workflows would side-load the implant. Persistence without ever installing a persistence mechanism, at the cost of breaking Sogou's software, which ESET dryly notes is destructive. Victims turned up in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, including a multinational gambling organisation, a Dubai internet café and, for some reason, a Danish university student. Tencent's version 16.10 moves the requests to HTTPS with certificate pinning, and ESET's CNA issued a CVE on 2 November. The unsettling part is nobody knows where the DNS manipulation happens: compromised routers, router implants or ISP-level interception are all on the table. ESET also says the fix leaves gaps because SGTool still doesn't validate downloaded file types or restrict destinations. Its post is internally inconsistent on the fix date, 29 October in the body and 30 October in the timeline box. The surveillance-alignment judgement is ESET's high-confidence assessment, and the group is distinct from Mustang Panda in its telemetry. Anyone with Sogou IME in the environment should be on 16.10, and the indicators are worth a look.

Finally, a short local one. New Zealand's NCSC is warning that malicious actors are distributing Android malware disguised as a job-seeking app, pushed through social media and chat messages, sometimes with a follow-up phone call for that personal touch. Sideload it and you get a fake Google Play update page for legitimacy, then a request for Accessibility permissions. Grant those and the scammer effectively owns the device. The NCSC notes the same malware also poses as banking apps, and recovery advice runs to a factory reset, because it can install further malware and a plain uninstall may not cut it. No family name or actor attribution, so don't read more into it than that.

That's the lot. Patch the thing that patches other things first, rotate what walked out the door, update the phones, and send the NCSC note to anyone who treats Accessibility prompts like terms and conditions. I'll see you next time.

Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat.