Overview
WordPress
WordPress has released a security update addressing multiple vulnerabilities in WordPress Core. No CVE identifiers have currently been published for these vulnerabilities.
The vulnerabilities include a weakness in the WordPress upgrade process that could lead to RCE during the upgrade window. The update also addresses multiple stored cross-site scripting (XSS) vulnerabilities, a stored denial-of-service vulnerability, and information disclosure and authorisation issues.
WordPress recommends updating sites immediately. Sites that support automatic background updates will begin the update process automatically.
Cisco
Cisco has released a security advisory to address a high-severity vulnerability in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software.
- CVE-2026-76418 - 'Unchecked Return Value to NULL Pointer De-reference' vulnerability - CVSS v3.1 Score: 8.6
Node.js
Node.js project disclosed CVE-2026-111497 in Google’s Brotli decoder used by Node.js and other software. The vulnerability is widely known as Node2Shell, Broccoli2Shell and HTTP2Shell.
- CVE-2026-111497 is an out-of-bounds write vulnerability in the Brotli decoder, with a CVSSv4 score of 9.2.
Successful exploitation could lead to memory disclosure, denial-of-service (DoS), or remote code execution (RCE).
Numerous security vendors, including Palo Alto Networks, Cisco, Fortinet and Microsoft, have published vendor advisories.
Recommended Action
Organisations are encouraged to review the appropriate security advisory pages and apply the updates:
Wordpress – 7.1.4. Security Release
Cisco – Security Advisory
Node.js – Affected organisations are encouraged to review the vendor advisories and apply the relevant updates as soon as possible.