# Your WordPress site is most hackable while updating it > Plus: cPGuard's own update channel shipped a backdoor, and APT29's mobile watering holes get an autopsy. - Series: It's Probably Nothing - Publisher: Sierra Echo Charlie - Edition date (Pacific/Auckland): 2026-11-05 - Edition number: 21 - Status: Published edition - Language: en-NZ - [Canonical web edition](https://ipn.nz/editions/2026-11-05) - [Download PDF](https://ipn.nz/pdf/IPN-2026-11-05.pdf) - [MP3 audio](https://ipn.nz/audio/IPN-2026-11-05.mp3) (7:42, 7399592 bytes) - [Standalone transcript](https://ipn.nz/transcripts/2026-11-05.md) ## Opening Busy one today. Two of the bigger stories involve update infrastructure being turned against its owners — one in WordPress core itself, one at a security vendor — plus a pair of genuinely good research drops from Sekoia and ESET, and a local warning worth forwarding to the less technical people in your life. ## 1. WordPress core's upgrade window is now a KEV-listed RCE CISA has added [CVE-2026-119977]() to the Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation. It's a TOCTOU race condition in WordPress core's own upgrade process: during a full-package upgrade, predictable, web-accessible staging paths let an unauthenticated attacker execute code on the server. The important caveat is the timing — this is only exploitable while a site is mid-upgrade, not a standing pre-auth RCE. But that's a window a huge chunk of the self-hosted web passed through recently, because the fix only shipped on 28 October in WordPress 7.1.4 (credited to reporter Umut Bayram, alongside a pile of mostly stored-XSS fixes). CISA's given US federal agencies until 6 November and flagged forensic triage as required, which is unusually brisk. Known ransomware campaign use is listed as Unknown. Wordfence's entry describes the affected range as 4.7.0 through 7.1.3 — effectively the entire fleet — though their detail page returned a 403, so that range comes from the entry's title rather than the full text. WordPress says backports are being shipped to all eligible branches down to 4.7 as they become ready, but only the latest version is actively supported. ### Worth asking If you run WordPress and did a full-package upgrade before 7.1.4 landed, the forensic triage language in the KEV entry is aimed at you. Patch, and have a look at what happened during the upgrade window. ### Qualifications No attack detail, actor or victim count is public beyond CISA's statement that exploitation is happening. ### Sources - [CISA Adds One Known Exploited Vulnerability to Catalog]() — primary source - [CISA Known Exploited Vulnerabilities Catalog (CSV)]() — primary source - [WordPress 7.1.4]() — primary source ## 2. cPGuard's autoupdate pushed a backdoor to ~2,900 servers OpsShield says an attacker used compromised credentials to get into its update distribution CDN at 02:06 UTC on 2 November, and used the cPGuard update channel itself to push a malicious script. Versions 5.88.12 through 5.88.19 are affected. The script installed a backdoor and collected Linux password hashes, root MariaDB/MySQL configuration, root shell history and root SSH files — exfiltrated, with a certain poetry, through OpsShield's own licensing server via a compromised account. The vendor told BleepingComputer 2,946 servers were affected and had that data copied, and that its billing system database went too. OpsShield says it detected the compromise and stopped distribution within 12 hours, and that some servers escaped because update checks run at intervals. How the credentials were obtained in the first place remains unclear. cPGuard is a security suite commonly bolted onto cPanel, DirectAdmin and Plesk boxes by hosting firms — the kind of software that's supposed to be the solution to this sort of problem. Root credential theft across thousands of shared-hosting servers has obvious second-order potential. ### Worth asking Version 5.88.25 removes the backdoor and staged files, but the collected credentials are already gone — passwords, database creds, cloud secrets and SSH keys all need rotating, not just patching over. ### Sources - [Hackers hijack cPGuard autoupdate to deploy backdoor, steal data]() — primary source - [cPGuard Update Channel Hijacked to Deploy Backdoor and Steal Server Credentials]() — reporting/context ## 3. APT29's mobile watering holes: cookies, keychains and a hijacked analytics firm Sekoia has published a thorough autopsy of a watering-hole campaign it uncovered in mid-October, and the most interesting part isn't the exploits — it's the plumbing. Three delivery vectors: compromised legitimate sites, lookalike reverse-proxy domains for america250.org and Raffles London at The OWO (the hotel near Whitehall where, per open-source reporting, Zelensky stayed on 14 October), and a one-week trojanisation of Ukrainian analytics service Plerdy's tracker between 27 August and 3 September, which exposed hundreds to thousands of predominantly Ukrainian sites including defence-sector and military-recruitment pages. Visitors on outdated iOS or Android got zero-click chains built entirely from known, patched vulnerabilities — no zero-days — including a full-device iOS 18.5 chain reusing the DarkSword commercial surveillance kit. Payloads stole browser cookies and, in some cases, message stores, keychain items and Wi-Fi passwords, with no persistence installed. Stolen session cookies mean webmail access without a password. Sekoia assesses APT29 (SVR) with moderate-to-high confidence, citing technical overlaps and victimology; Google TAG confirmed the framework resembles APT29's 2024 Mongolian watering-hole work and that the exploits match commercial surveillance vendor tooling. A state actor shopping from the CSV catalogue is becoming a pattern. Fully updated devices were never at risk — this one punished the unpatched. ### Qualifications Attribution is Sekoia's assessment, moderate-to-high confidence, with Google TAG corroboration. ### Sources - [Poisoned Source: APT29 watering holes target mobile devices with n-day exploits]() — primary source - [Suspected Russian SVR Campaign Targets Mobile Devices to Steal Login Cookies]() — reporting/context ## 4. Sogou's insecure config fetch became a DarkVigil delivery service ESET has detailed a DNS hijacking operation by SlippyNunchucks, the China-aligned group behind the DarkVigil toolset. Since 1 July, whoever controlled DNS resolution for config.pinyin.sogou.com could answer the Sogou Input Method's unencrypted HTTP brand-promotion requests with a malicious configuration, telling the legitimate SGTool.exe to fetch a signed Adobe binary and a malicious libcef.dll — then plant them where Sogou's own component workflows would side-load the implant. Persistence without ever installing a persistence mechanism, at the cost of breaking Sogou's software in the process, which ESET dryly notes is destructive. Victims turned up in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, including a multinational gambling organisation, a Dubai internet café and, for some reason, a Danish university student. Tencent's version 16.10 moves the requests to HTTPS with certificate pinning, and ESET's CNA issued CVE-2026-120422 on 2 November. The unsettling part is that nobody knows where the DNS manipulation happens — compromised routers, router implants or ISP-level interception are all on the table. ESET also notes the fix leaves residual gaps: SGTool.exe still doesn't validate downloaded file types or restrict destinations. ### Worth asking Anyone with Sogou IME in the environment should be on 16.10, and the IoCs are worth a look. ### Qualifications ESET's post is internally inconsistent on the fix date (29 October in the body, 30 October in the timeline box). The surveillance-alignment judgement is ESET's high-confidence assessment; the group is distinct from Mustang Panda in their telemetry. ### Sources - [SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware]() — primary source - [SlippyNunchucks Exploits Sogou DNS Hijacking to Deploy DarkVigil Surveillance Malware]() — reporting/context ## 5. NCSC: the fake job app wants your Accessibility permissions A short local one to finish. New Zealand's NCSC is warning that malicious actors are distributing Android malware disguised as a job-seeking app, pushed through social media and chat messages, sometimes with a follow-up phone call for that personal touch. Sideload it and you get a fake Google Play update page for legitimacy, then a request for Accessibility permissions — grant those and the scammer effectively owns the device. The NCSC notes the same malware also poses as banking apps, and its recovery advice runs to a factory reset, because the thing can install further malware and a plain uninstall may not cut it. No family name or actor attribution, so don't read more into it than that. ### Sources - [Fake job app installs malware on Android phones]() — primary source ## Audio transcript Narrated using an AI voice. Good morning, and welcome to It's probably nothing for the edition dated 5 November 2026. Busy one today. Two of the bigger stories are update infrastructure being turned against its owners: one in WordPress core itself, one at a security vendor. There are also two genuinely good research drops from Sekoia and ESET, and a local warning worth forwarding to the less technical people in your life. CISA has put a WordPress core bug on the Known Exploited Vulnerabilities list, saying there's evidence of active exploitation. It's a time-of-check, time-of-use race in WordPress's own upgrade process: during a full-package upgrade, predictable, web-accessible staging paths can let an unauthenticated attacker run code on the server. The key caveat is timing. This is exploitable while a site is mid-upgrade, not a standing pre-auth remote code execution. But a huge chunk of the self-hosted web passed through that window recently, because the fix only landed on 28 October in WordPress 7.1.4, credited to reporter Umut Bayram alongside a pile of mostly stored XSS fixes. CISA has given US federal agencies until 6 November and says forensic triage is required, which is unusually brisk. Known ransomware campaign use is listed as unknown. Wordfence describes the affected range as 4.7.0 through 7.1.3, effectively the whole fleet, though its detail page returned a 403, so that range comes from the entry title rather than the full text. WordPress says backports are going to eligible branches down to 4.7 as they're ready, but only the latest version is actively supported. If you did a full-package upgrade before 7.1.4 landed, patch and look at what happened during the upgrade window. Beyond CISA saying exploitation is happening, there's no public attack detail, actor or victim count. OpsShield says an attacker used compromised credentials to get into its update distribution CDN at 02:06 UTC on 2 November, then used the cPGuard update channel itself to push a malicious script to recent 5.88 builds. The script installed a backdoor and collected Linux password hashes, root MariaDB or MySQL configuration, root shell history and root SSH files, then exfiltrated it, with a certain poetry, through OpsShield's own licensing server using a compromised account. The vendor told BleepingComputer 2,946 servers were affected and had that data copied, and that its billing system database went too. OpsShield says it detected the compromise and stopped distribution within 12 hours, and some servers escaped because update checks run at intervals. How the credentials were obtained remains unclear. cPGuard is the sort of security suite hosting firms bolt onto cPanel, DirectAdmin and Plesk boxes, so root credential theft across thousands of shared-hosting servers has obvious second-order potential. The fixed release removes the backdoor and staged files, but the collected credentials are already gone: passwords, database creds, cloud secrets and SSH keys need rotating, not just patching over. Sekoia has published a thorough autopsy of a watering-hole campaign it uncovered in mid-October, and the interesting part is the plumbing. Delivery came three ways: compromised legitimate sites, lookalike reverse-proxy domains for america250.org and Raffles London at The OWO, the hotel near Whitehall where open-source reporting says Zelensky stayed on 14 October, and a one-week trojanisation of Ukrainian analytics service Plerdy's tracker between 27 August and 3 September. That exposed hundreds to thousands of predominantly Ukrainian sites, including defence-sector and military-recruitment pages. Visitors on outdated iOS or Android got zero-click chains built entirely from known, patched vulnerabilities, no zero-days, including a full-device iOS 18.5 chain reusing the DarkSword commercial surveillance kit. Payloads stole browser cookies and, in some cases, message stores, keychain items and Wi-Fi passwords, with no persistence installed. Stolen session cookies mean webmail access without a password. Sekoia assesses APT29, the SVR, with moderate-to-high confidence based on technical overlaps and victimology; Google TAG confirmed the framework resembles APT29's 2024 Mongolian watering-hole work and that the exploits match commercial surveillance vendor tooling. Fully updated devices were never at risk. This one punished the unpatched. ESET has detailed a DNS hijacking operation by SlippyNunchucks, the China-aligned group behind the DarkVigil toolset. Since 1 July, whoever controlled DNS resolution for Sogou's config domain could answer the Sogou Input Method's unencrypted HTTP brand-promotion requests with a malicious configuration, telling the legitimate SGTool.exe to fetch a signed Adobe binary and a malicious libcef DLL, then plant them where Sogou's own component workflows would side-load the implant. Persistence without ever installing a persistence mechanism, at the cost of breaking Sogou's software, which ESET dryly notes is destructive. Victims turned up in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, including a multinational gambling organisation, a Dubai internet café and, for some reason, a Danish university student. Tencent's version 16.10 moves the requests to HTTPS with certificate pinning, and ESET's CNA issued a CVE on 2 November. The unsettling part is nobody knows where the DNS manipulation happens: compromised routers, router implants or ISP-level interception are all on the table. ESET also says the fix leaves gaps because SGTool still doesn't validate downloaded file types or restrict destinations. Its post is internally inconsistent on the fix date, 29 October in the body and 30 October in the timeline box. The surveillance-alignment judgement is ESET's high-confidence assessment, and the group is distinct from Mustang Panda in its telemetry. Anyone with Sogou IME in the environment should be on 16.10, and the indicators are worth a look. Finally, a short local one. New Zealand's NCSC is warning that malicious actors are distributing Android malware disguised as a job-seeking app, pushed through social media and chat messages, sometimes with a follow-up phone call for that personal touch. Sideload it and you get a fake Google Play update page for legitimacy, then a request for Accessibility permissions. Grant those and the scammer effectively owns the device. The NCSC notes the same malware also poses as banking apps, and recovery advice runs to a factory reset, because it can install further malware and a plain uninstall may not cut it. No family name or actor attribution, so don't read more into it than that. That's the lot. Patch the thing that patches other things first, rotate what walked out the door, update the phones, and send the NCSC note to anyone who treats Accessibility prompts like terms and conditions. I'll see you next time. Don't forget, all our threat intelligence comes from Mallory dot A I and open sources. If you want intelligence your team can act on, reach out for a chat. ## Publisher Researched by our AI agents using [Mallory](https://mallory.ai) and original sources. Reviewed and published by [Sierra Echo Charlie](https://sierraechocharlie.com). Want intelligence your team can act on? [Reach out for a chat.](mailto:letsgo@sierraechocharlie.com)