Tag
WPBeginner's October roundup highlights WordPress plugins gaining AI agent capabilities (OptinMonster MCP, WPVibe.ai surpassing 100k users and joining Claude's Connectors Directory), the WP Crontrol 2.0 handoff, and critical PHP vulnerabilities disclosed on October 21.
CVE-2026-98432 is a use-after-free vulnerability in the IPv4 TCP handshake path affecting all kernels from Linux 4.4 onward. It can be triggered without authentication via crafted packets carrying IP options, causing kernel crashes, memory leaks, or remote code execution (RCE has already been demonstrated in MPTCP environments). Ubuntu fixes are still in progress, and AWS states that upgrading the kernel and rebooting is the only complete remediation.
Ubuntu has yet to ship patched LTS kernels for critical CVE-2026-98432, a CVSS 9.8-rated Linux kernel RCE, leaving 22.04, 24.04, and 26.04 users exposed for nearly three weeks with no announced ETA for fixes.
Ubuntu is criticized for failing to patch CVE-2026-98432, a critical CVSS 9.8 Linux kernel TCP bug with a working root exploit, more than two weeks after Debian and other distros shipped fixes, prompting the author to migrate servers off Ubuntu.
A critical Linux vulnerability allows complete takeover of any unpatched server with a single exposed TCP port and MPTCP enabled, which is the default for many Go web servers.
Linux's stable kernels shipped fixes for CVE-2026-98432, a critical (CVSS 9.8) use-after-free in the IPv4 TCP handshake reachable by remote unauthenticated attackers; Anthropic reported the bug and says its Claude model wrote a working remote root exploit, while Ubuntu and RHEL remain unfixed.
Linux 河修复了 CVE-2026-98432，一个 CVSS 9.8 严重的 IPv4 TCP 握手 use-after-free 漏洞，可被远程未认证攻击者利用；Anthropic 的 Claude 生成了可远程 root 的 PoC，而 Ubuntu 和 RHEL 等主流发行版仍未发布修复补丁。
Parameter Labs researchers disclosed a cross-frame message passing flaw that chained ChatGPT's HTML Preview sandbox with MathLive's unvalidated postMessage listener, letting a shared conversation run attacker JavaScript in a victim's signed-in session and take over their account. OpenAI fixed the P1 issue on October 26, and no user action beyond opening the link was required.
A critical Linux kernel TCP vulnerability with a 9.8 CVSS score has been disclosed, affecting Ubuntu, Red Hat, and other major distributions, prompting widespread patching efforts.
Linux 内核 MPTCP TCP 缺陷被评为 9.8 CVSS，Anthropic 演示了可在服务器上以 root 权限执行命令的漏洞利用，Ubuntu 和 RHEL 尚未修复，而 Debian、Oracle 等已发布部分补丁。
A zero-click vulnerability called 'SMS of Death' lets a single malformed WAP Push SMS crash Android's com.android.phone process, dropping active calls (including emergency calls) and potentially bricking telephony via SQLite corruption; Google classified it as non-security and won't fix.
研究人员发现多个 PDF 实现（如 MuPDF 和 Foxit）在生成 AES-256 文件密钥时使用了极弱的随机性——MuPDF 的密钥仅受 9 比特随机状态影响，可通过暴力枚举实现无密码解密受保护的 PDF 文档。
一个评分 9.5/10 的严重 UEFI 固件漏洞（CVE-2026-97631）出现在几乎所有服务器厂商使用的 TianoCore EDK2 代码库的 ICMP 组件中，可在 Secure Boot 生效前执行代码，且补丁已提前泄露。
OpenAI 的红队演练发现 Brotli 压缩库存在未认证远程代码执行漏洞，影响 Node.js、Bun、Envoy 等广泛部署的软件；相关修复已通过 CVE 和下游安全更新发布。
AWS threat intelligence reveals attackers began exploiting the critical PHP2Shell vulnerabilities four days before their public disclosure and patch release, highlighting how AI-accelerated exploit development is shrinking the window between patch and working exploit.
两个评分高达9.2/10的PHP远程代码执行漏洞（php2shell）被公开，官方已发布紧急补丁版本，要求所有PHP服务立即升级，否则可能遭遇在野利用。
研究人员发现 Meta 新推出的通用 AI 代理 Muse 的分享链接存在设计缺陷，可通过被动 DNS 枚举轻松获取用户私密对话内容，Meta 已暂停该分享功能并展开审查。
A critical PHP vulnerability with a 9.2 severity score threatens to allow full server compromise, with fears that attackers will use AI to reverse-engineer the patch within 15 minutes of its release, alongside a publicly leaked exploit.
Telegram Desktop中披露了一个安全漏洞，攻击者可利用该漏洞窃取任意用户的文件。该漏洞影响桌面客户端用户，属于严重的数据泄露风险。
curl 8.23.0 will be released early on October 14, 2026 to address one HIGH-severity vulnerability (CVE-2026-92392) along with 21 other, less serious security flaws.