WordPress sites running versions 4.7.0 through 7.1.1 are under active attack through CVE-2026-93485, a critical vulnerability that lets unauthenticated attackers execute malicious code via comments. Attackers are writing PHP files to vulnerable servers, so you must update to version 7.1.2 now.
WordPress sites are under active attack through CVE-2026-93485, a critical vulnerability in WordPress Core versions 4.7.0 through 7.1.1 that allows unauthenticated attackers to execute code via malicious comments. The flaw has been fixed in version 7.1.2, but exploitation began immediately after disclosure on September 22nd, with attackers now attempting to write malicious PHP files to vulnerable servers. Site owners must update immediately.
A malicious Google Ads campaign is distributing fake security alerts that lock browsers and pressure victims into calling fraudulent tech support numbers. The scam pages are hosted on legitimate cloud infrastructure and use social engineering to extract money, remote access credentials, or personal information. Users encountering locked browser screens should force-quit the browser and remember that legitimate security warnings never include phone numbers.
CISA has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: two affecting Check Point Security Gateway, Firewall, and Management products, and CVE-2026-5430 affecting WSO2 API Control Plane, API Manager, Traffic Manager, and Identity Server. Organizations using these products must apply patches immediately as these flaws are confirmed to be under active exploitation.
Researchers have discovered that file-change notification systems in Windows, Linux, and Android can leak sensitive user activity including keystroke timing, browsing patterns, and WhatsApp media events. Any application with basic permissions can subscribe to these system-level notifications, creating a side-channel for surveillance. This is a fundamental design issue with no immediate patch, reinforcing the importance of limiting installed software and maintaining current antivirus protection.
Attackers exploited a known vulnerability in Samsung MagicINFO digital signage software to compromise a Windows system, then constructed a cryptocurrency miner on the victim machine rather than deploying pre-built malware. This assembly-on-target technique evades many detection systems and demonstrates how even non-critical systems like display management can provide network entry points when left unpatched.
Which wordpress vulnerability attack should your SMB address first?
CVE-2026-93485 in WordPress Core is actively exploited in the wild as of September 22nd. Check Point Security Gateway and WSO2 API products also carry confirmed exploits tracked by CISA. For professional services and manufacturing firms, the priority chain is clear: patch WordPress to 7.1.2 immediately, verify your firewall and API management systems are current, and audit what non-critical systems (like Samsung MagicINFO digital signage) sit on your network unpatched. Unpatched display software became an entry point for cryptocurrency miners in recent attacks. Downtime from exploitation costs far more than update time.
Key takeaways
- WordPress 4.7.0 to 7.1.1 allows remote code execution via malicious comments. Update to 7.1.2 today.
- Google Ads campaign spreading fake security warnings that lock browsers and demand payment or credentials. Force-quit the browser if locked.
- CISA confirms active exploitation of Check Point Security Gateway and WSO2 API products. Patch immediately.
- Even display management software (Samsung MagicINFO) can serve as a network entry point when left unpatched.
Frequently asked questions
What happens if we don't patch the WordPress vulnerability attack?
Attackers can execute arbitrary PHP code on your server, write files to disk, steal customer data, or deploy ransomware. Exploitation began immediately after public disclosure, so delay increases your risk of breach or downtime.
How do we know if our WordPress site was already compromised by the vulnerability attack?
Review your web server logs for malicious comments or new PHP files in uploads directories since September 22nd. Check your WordPress user list for unfamiliar accounts. If you suspect compromise, take the site offline, run a full backup, and engage a security firm to scan for backdoors before going live again.
Is the Google Ads scam a vulnerability attack on our systems?
No, it's social engineering. The scam displays fake security alerts in your browser and tricks you into calling fraudulent support or sharing passwords. Legitimate security warnings never include phone numbers. Force-quit your browser and clear your cache if you see one.
Do we need to check Check Point and WSO2 if we don't use those products?
Only if your firewall or API management systems are made by Check Point or WSO2. If you use different vendors, verify they have released patches for CVE-2026-5430 or related flaws. Ask your vendor directly for patch status.
Sources
- https://cybersecuritynews.com/wordpress-comment2shell-vulnerability/
- https://cybersecuritynews.com/google-ads-campaign/
- https://cybersecuritynews.com/check-point-product-vulnerabilities-exploited/
- https://cybersecuritynews.com/wso2-vulnerability-exploited/
- https://www.securityweek.com/windows-linux-android-file-notification-systems-leak-user-activity/
- https://cybersecuritynews.com/samsung-flaw/