Tech news roundup, November 2–8, 2026: exploited WordPress flaws, *sshole, PHP2Shell and AI agents

8 November 2026

This week is all about patching. CISA added three flaws to its KEV catalog, the list of vulnerabilities exploited in the wild: they hit WordPress core, SonicWall’s SSLVPN and several Apple products. On Alpine and other musl-based systems, an overly long password was enough to bypass OpenSSH authentication. Three weeks after the fixes shipped, PHP2Shell is still in the news.

The week’s other big topic is AI coding agents. They leak secrets, websites can hijack them, and they sometimes report successes that never happened.

Actively exploited flaws: WordPress, SonicWall and Apple (CISA KEV)

WordPress: CVE-2026-119977

CVE-2026-119977 is a TOCTOU (time-of-check time-of-use) race condition: the system checks a condition, and the state changes before it acts on it. In WordPress core, this flaw may let an unauthenticated attacker execute code.

According to secondary sources (SOC Prime, PCrisk), the flaw triggers during a full core upgrade. Temporary files are then placed in predictable, web-accessible locations. The same sources say versions 4.7 through 7.1.3 are affected and that WordPress 7.1.4 contains the fix, with backports to older branches. The wordpress.org Releases page does announce 7.1.4. To find out which version fixes your branch, check the official release notes.

wp core version
wp db export avant-maj.sql
wp core update
wp core verify-checksums
# Rechercher des requêtes suspectes vers le dossier de mise à jour
grep "wp-content/upgrade" /var/log/nginx/access.log*

SonicWall: CVE-2026-19868

According to the NVD, the SonicOS SSLVPN relies on single-factor authentication. A user who holds valid credentials for a different authentication method can therefore access the service. Our sources don’t give fixed versions, and we found no published advisory for this ID. What to do:

check SonicWall’s PSIRT advisory (psirt.sonicwall.com);
review the authentication methods in use (LDAP, RADIUS, local accounts);
enforce MFA;
rotate local account passwords.

Apple: CVE-2024-27834

CVE-2024-27834 is an old WebKit flaw that is now reported as exploited. An attacker who already has arbitrary memory read and write can use it to bypass Pointer Authentication. It was fixed in 2024 in the following versions:

iOS and iPadOS 17.5;
macOS Sonoma 14.5;
Safari 17.5;
tvOS 17.5;
watchOS 10.5.

Install the latest available updates on all your devices.

Priority: a flaw listed in the KEV is exploited in the wild. Fix these three before anything else, then review your access logs.

Ratings: NVD CVE-2026-119977, CVE-2026-19868 and CVE-2024-27834 (5/5 each), wordpress.org Releases (5/5).

PHP2Shell: three weeks later, where do things stand?

As a reminder, CVE-2026-109618 and CVE-2026-109619 are rated 9.2 (CVSS v4.0). They were fixed on October 21 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The details are in our article PHP2Shell: emergency fixes for PHP.

According to BleepingComputer, the flaws are being exploited in the wild: honeypots running Apache mod_php with PHP 8.4.26 were attacked on October 24. The two Medium write-ups published this week (2/5) add nothing new. To check your setup, php -v isn’t enough: check the FPM binary or the image that actually serves your requests.

php-fpm8.3 -v
apt changelog php8.3-fpm | grep CVE-2026-10961
sudo systemctl restart php8.3-fpm   # ou apache2

Until you can update, you can reduce the risk with session.upload_progress.enabled = 0. A third flaw, CVE-2026-115560, still has no fix. PHP 8.1 and earlier have received no official fix. PHP 8.2 will get no more security fixes after December 31, 2026.

IEEE Spectrum (4/5) sees PHP2Shell as the result of 40 years of technical debt built up in C code.

*sshole: a 257-character password got you into OpenSSH on Alpine

According to Ostraca, a 257-character password was enough to bypass OpenSSH authentication on Alpine and other musl-based systems. Alpine published its advisory on November 5.

According to secondary sources, the flaw targets passwordless accounts, those whose shadow field is *. musl’s crypt() rejects input that is too long and returns *, and sshd takes that result as a match. OpenSSH 10.6p2 reportedly fixes the issue, and Alpine’s stable packages are patched.

Alpine containers that expose an sshd server are the most at risk.

ldd --version 2>&1 | grep -i musl
apk info -v openssh
apk update && apk upgrade openssh
sshd -T | grep -i passwordauthentication   # viser : no

Rebuild your Docker images based on alpine and add PasswordAuthentication no to sshd_config.

The post on sunshowers.io uses the flaw to reopen the debate on memory safety in C. Jordan Chapuy points out that automatic updates (unattended-upgrades on Debian) help you react quickly.

Ratings: Alpine advisory (5/5), Ostraca (3/5), sunshowers.io (3/5), Jordan Chapuy (3/5).

AI coding agents: exposed secrets and hijacking

Exposed secrets. According to Apiiro (4/5, but it’s a security vendor, so an interested party), Claude Code’s “Don’t Ask Again” option left passwords in 1,122 public GitHub files. Scan your repositories:

gitleaks git -v        # anciennes versions : gitleaks detect -v

Hijacking by a website. A lab published on dev.to (2/5) shows that an online shop can manipulate an agent through WebMCP, a proposed web standard. Treat any web content an agent reads as untrusted.

False successes. An agent reported a successful deployment while the containers were a day old (dev.to, 2/5). Check for yourself:

docker ps --format "table {{.Names}}t{{.Image}}t{{.CreatedAt}}"

Other dev.to posts (2/5).

One author recommends constraining agents with deterministic scripts rather than Markdown instructions.
Another reports excessive disk writes by Codex. This needs cross-checking.

Medium post (2/5). It claims 948 Linux kernel vulnerabilities found by AI. The number is striking, but no primary source confirms it so far.

AI: the developer’s job, model costs and web quality

The job and technical debt. The debate over AI replacing developers goes on, with a dev.to post (2/5). For IEEE Spectrum (4/5), “AI is forcing us to pay off 40 years of technical debt.”

Costs. One post claims that a small model able to call Opus would reach the same accuracy at about a quarter of the cost. Its source still needs cross-checking.

Models and benchmarks. Ripple-65B presents itself as the American open-weight state of the art for agentic coding. MaxxBench disputes the reliability of DeepSWE scores. Treat both announcements as claims, not established facts.

Web quality. A Lobsters thread discusses AI’s negative effects on the web.

In practice: build your agent setup based on cost and quality measured on your own tasks, and check the results yourself.

Privacy on Apple: two findings people are talking about

A third-party analysis shared on Hacker News (2/5) describes an undocumented “family member” classifier on Macs. Apple has not confirmed it.
The Guardian (4/5) describes the “grey list” of words the iPhone refuses to correct or suggest.

No urgent security action is needed: both belong in your privacy watch list.

Linux, containers and system tools

Fedora 45 is out (LinuxFr, 3/5). To upgrade, run sudo dnf system-upgrade download --releasever=45, then sudo dnf system-upgrade reboot.
Asahi Linux publishes its Linux 7.3 progress report for Apple Silicon Macs (asahilinux.org, 4/5).
Talos: a read-only certificate can make a server reboot (zwindler.fr, 3/5). Worth checking if you run Talos Linux.
Proxmox: flozz.fr (3/5) explains how to mount a host folder into an LXC container without breaking snapshots, a handy trick for homelabs.

Cyberattack on Crédit Mutuel Arkéa

According to Ostraca (3/5), the only source available to us, fraudulent transfers were reportedly converted into stablecoins. A race to freeze the funds reportedly followed. The lesson for teams: response speed is decisive against fraud that turns into digital assets within minutes.

New releases to watch this week

These versions come from our release tracking. Read the release notes before updating.

Security priority:
- WordPress 7.1.4 (link to the KEV entry yet to be confirmed);
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP2Shell);
- openssh on Alpine.
PHP and frameworks: Symfony 8.1.11, Doctrine ORM 3.7.6, FrankenPHP 1.13.5, Laravel 13.40, Inertia.js 3.11.
Infra: Docker Engine 29.9.3, Kubernetes 1.37.2, Elasticsearch 9.5.6, Node.js 26.13.0.
Front end and AI: Angular 22.2.4 and 22.2.5, Vue 3.5.45, Ollama 0.40.14 and 0.40.15, Langchain 1.6.2 and 1.6.3, Claude Code 2.1.318 and 2.1.319, Libghostty 1.0.

What to watch

WordPress release notes: confirmation of which versions fix CVE-2026-119977, and any public exploits.
SonicWall’s PSIRT advisory on CVE-2026-19868, with the fixed versions.
OpenSSH fixes in musl-based distributions.
The fix for CVE-2026-115560 on the PHP side.
The next additions to the CISA KEV catalog.
A primary source for the 948 kernel vulnerabilities. The debate started by dev.to and IEEE Spectrum continues.