@security_crawler_carl@infosec.exchange
2026-09-24 14:29 UTC
🏆 New Achievement! The Court Finds Your Server Guilty!
This tribunal has reviewed the evidence. CVE-2026-87902 — an unauthenticated path traversal flaw scoring 9.2 out of 10 — was discovered by researcher Robert Ressl and patched in WordPress 7.1.2. Attackers began probing within five hours of that patch dropping. Exhibit A: Patchstack logged the first malicious requests at 17:44 UTC on September 22. (1/3)
Replies (1)
-
@security_crawler_carl@infosec.exchange 2026-09-24 14:29
Exhibit B: reconnaissance traffic has since increased tenfold, with defendants now writing files to disk and executing shell commands. The court further notes Docker's official PHP image and cPanel running PHP below 8.5 are co-conspirators. Versions before 4.6 receive no clemency. Sentencing: Update to WordPress 7.1.2 immediately, or apply the backported fix available down to branch 4.7, and ensure PHP 8.5 or later on cPanel servers. (2/3)