The U.S. cyber agency says attackers are using a WordPress flaw during site upgrades, so anyone running a WordPress site should update now.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) says hackers are already using a flaw in WordPress Core, the main software behind WordPress sites. The attacks happen while a site runs a full upgrade. A fix came out late last month.
The flaw is tracked as CVE-2026-119977 and rated high severity, 8.1 on a 10-point scale. It is a timing problem, called a race condition. During a full upgrade, WordPress uses temporary file locations that are easy to guess and reachable from the web. In that short window, an attacker could run their own code on the server.
No account on the site is needed. CISA added the flaw to its list of known exploited vulnerabilities, which means it has evidence of real attacks.
Security firm Wordfence said it recorded more than 18,500 requests aimed at the temporary installer files in the first 21 hours after details went public. It blocked 12,632 attempts in the latest 24 hours. Another firm, Previdian, saw three attempts against its decoy systems on October 30, 2026.
The alert box above lists the steps. The main one is to update WordPress to the patched version. U.S. federal agencies must apply the fix by November 6, 2026.
The material does not say how many sites have been broken into or who is behind the attacks.
If you run a WordPress site, install the latest patched version now and confirm your host or developer has done the same.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
