Thursday's lead comes with the shortest government clock of the season: CISA confirmed attackers are exploiting a flaw in the way WordPress updates itself and gave federal agencies three days to fix it, ending tomorrow. Further down, a two-year-old Apple bug just proved that an old patch left uninstalled is a current problem. Here is the longer version of today's five, with the version numbers and links that do not fit in three minutes.
WordPress: code execution in the upgrade window, patch by November 6
CVE-2026-119977 is a time-of-check time-of-use race condition in WordPress Core's upgrade path: while a site is unpacking a new version, an unauthenticated attacker who times the request right can get their own code onto the server. CISA added it to the Known Exploited Vulnerabilities catalog on November 3 "based on evidence of active exploitation", and the catalog entry gives federal civilian agencies until November 6, three days instead of the usual weeks, which is CISA's way of saying act now. BleepingComputer reports the flaw rates CVSS 8.1 and is under active attack. Affected versions run from WordPress 4.7, which shipped in December 2016, through 7.1.3; the fix is WordPress 7.1.4, released October 28. Two practical notes. First, the vulnerable moment is the upgrade itself, so the answer is not to stop updating: a site sitting on an old version stays exposed every time it eventually does update, and to everything else fixed since. Second, most WordPress sites a company owns are not run by the security team, so this one is worth forwarding to whoever actually holds the keys, with one question: are we on 7.1.4, and are automatic core updates on.
The fix watch: quiet, with Patch Tuesday five days out
Microsoft has posted no new fixes since the October 27 updates, which carry the Smart App Control repair and the Remote Desktop 0xC000000D fix in KB5127653 and KB5127936. The next Patch Tuesday is November 10.
Exchange: Outlook on the web sign-in, day twenty-three
Since the October 13 Windows Server updates, Microsoft says: "Users might be unable to sign in to OWA or send emails on Exchange Server". Windows release health still lists it as Mitigated, a workaround but no fix, across Windows Server 2016 through 2025, unchanged since October 16. The affected updates include KB5126646, KB5126655 and KB5126651. If next week's Patch Tuesday carries the fix, it will land on servers that have this month's workaround in place, so know which of yours do.
The install watch: still quiet
No new "this update fails to install" issues from Microsoft; the most recent known-issue changes remain the October 28 fix entries above. If an update fails at your place anyway, note the error code before calling IT: a quiet week means the cause is more likely local than a known problem.
Apple: patched in May 2024, exploited now
CVE-2024-27834 is a WebKit flaw that lets an attacker who already has a read-and-write foothold bypass Pointer Authentication, one of the chip-level defenses on Apple hardware. It was demonstrated at the Pwn2Own Vancouver contest, run by Trend Micro's Zero Day Initiative, in March 2024, and Apple fixed it that May in the iOS and iPadOS 17.5 and Safari 17.5 round of updates. On November 4, CISA added it to the Known Exploited Vulnerabilities catalog "based on evidence of active exploitation", with a federal deadline of November 18. The catalog scores it CVSS 5.5, modest on paper because it needs that existing foothold, which is exactly how it gets used: as one link in a longer attack chain. The lesson is not subtle. Any Apple device updated since May 2024 has been protected from this for two and a half years; the ones in danger are the devices nobody updates because nobody owns them. Conference-room Macs, lobby iPads, the test iPhone in a drawer: this week, find them and update them.
If you do three things this week
- Ask whoever runs your WordPress sites, today, whether every one of them is on 7.1.4 or later and has automatic core updates on; the federal deadline for this flaw is tomorrow, November 6.
- If you run Exchange, list which servers carry the October OWA workaround before Patch Tuesday on November 10, so next week's update lands on a known state.
- Sweep for Apple devices that have not updated since May 2024, starting with the shared and unowned ones, and update them.
Clay in the Morning is Senserva's weekday patch and security show; this is its written companion. The sources behind our trackers, and their terms, are on our Data sources & thanks page.