Security news.
Today's security roundup is headlined by CISA's warning over active exploitation of a high-severity WordPress core flaw, alongside critical patches for Ruby on Rails and the Xen hypervisor. Threat actors are also ramping up sophisticated supply-chain attacks and offensive AI workflows, targeting widely used tools and enterprise developer platforms. Meanwhile, massive monthly updates from Google bring urgent fixes for zero-click vulnerabilities across millions of devices.
CISA Adds Exploited WordPress Race Condition Flaw to KEV Catalog
Attackers are actively targeting CVE-2026-119977 (CVSS 8.1), a time-of-check time-of-use race condition in WordPress Core that allows arbitrary code execution during software upgrades.
Critical Ruby on Rails Flaw Enables Arbitrary File Overwrites
The Rails project released updates for versions 8.1.4.1 and 8.0.5.2 to address a critical vulnerability in Active Storage that allows unauthenticated attackers to write server files via crafted ImageMagick uploads.
Xen Hypervisor Bugs Enable Cross-VM Memory Access
Two unmitigated flaws in the Xen hypervisor spanning version 4.6 onward permit malicious guest virtual machines to read and write memory across other VMs, including the privileged dom0 domain.
Google Patches Critical Android Zero-Click Remote Code Execution Vulnerability
Tracked as CVE-2026-58868, the high-risk flaw affects Android versions 14 through 17 and enables attackers to remotely execute code without user interaction.
Poisoned cPGuard Updates Distributed in OpsShield Supply Chain Compromise
Attackers leveraged compromised credentials to access OpsShield update infrastructure, pushing backdoors and data stealers through corrupted releases of the cPGuard security suite.
AI-Linked Breaches Hit WorkOS, Northflank, and Trigger.dev
Attackers automated multi-stage intrusions by harvesting AI access tokens and using AI-assisted tooling to breach developer and enterprise cloud environments.
Russian Hackers Launch Zero-Click iOS and Android Watering Hole Attacks
A large-scale campaign has been observed exploiting n-day mobile vulnerabilities in zero-click drive-by intrusions using spoofed portals and compromised sites.
Chrome 157 Ships With Over 200 Security Fixes, Seven Rated Critical
Google's latest stable browser update patches dozens of memory safety bugs and severe authorization flaws across the platform.