Hacking DeskVictoria Police warn of AI fake-doctor gift card scam How-to DeskHow to spot a fake shopping site before Black Friday AmplifiedAnberlin — Never Take Friendship Personal Hacking DeskRansomware negotiator charged, ShinyHunters link reported How-to DeskHow to set up a digital legacy for Apple and Google AmplifiedEmery — The Question How-to DeskHow to run Chrome's Safety Check and tighten privacy How-to DeskHow to move to a new phone and wipe the old one AmplifiedDemon Hunter — Summer of Darkness How-to DeskHow to lock down your WhatsApp privacy settings How-to DeskHow to lock down your Apple Account AmplifiedNorma Jean — Bless the Martyr and Kiss the Child How-to DeskHow to check every protection in Windows Security How-to DeskHow to check your Mac's security settings How-to DeskHow to check if your email was in a data breach How-to DeskHow to cancel subscriptions on iPhone and Android How-to DeskHow to ask a company what personal data it holds on you How-to DeskHow to use a travel eSIM on your iPhone overseas How-to DeskHow to lock down your home Wi-Fi router How-to DeskHow to screen scam calls on iPhone and Pixel

Hacking DeskVictoria Police warn of AI fake-doctor gift card scam How-to DeskHow to spot a fake shopping site before Black Friday AmplifiedAnberlin — Never Take Friendship Personal Hacking DeskRansomware negotiator charged, ShinyHunters link reported How-to DeskHow to set up a digital legacy for Apple and Google AmplifiedEmery — The Question How-to DeskHow to run Chrome's Safety Check and tighten privacy How-to DeskHow to move to a new phone and wipe the old one AmplifiedDemon Hunter — Summer of Darkness How-to DeskHow to lock down your WhatsApp privacy settings How-to DeskHow to lock down your Apple Account AmplifiedNorma Jean — Bless the Martyr and Kiss the Child How-to DeskHow to check every protection in Windows Security How-to DeskHow to check your Mac's security settings How-to DeskHow to check if your email was in a data breach How-to DeskHow to cancel subscriptions on iPhone and Android How-to DeskHow to ask a company what personal data it holds on you How-to DeskHow to use a travel eSIM on your iPhone overseas How-to DeskHow to lock down your home Wi-Fi router How-to DeskHow to screen scam calls on iPhone and Pixel

Saturday 17 October 2026

WordPress CVE-2026-87902 joins CISA KEV list

WordPress shipped 7.1.2 for an unauthenticated file-inclusion bug that can lead to code execution. CISA put it on the KEV list.

Quin Halberg Saturday 17 October 2026, open calendar4 min read

Screenshot: WordPress Foundation / Wikimedia Commons (GPL), cropped

Listen

Free browser voice. Starts at once.

Uses text-to-speech.

WordPress shipped an emergency security release after researchers found a way for an unauthenticated attacker to pull unexpected PHP files into page-template resolution. Under the wrong theme and server conditions, that becomes remote code execution. The bug is CVE-2026-87902.

The WordPress 7.0 admin dashboard with its dark sidebar menu and site health, activity and news panels — Screenshot: WordPress Foundation / Wikimedia Commons (GPL), cropped

Read next

More in Hacking →

Say hello in our guest book

Published

Quin Halberg Saturday 17 October 2026 at 9:29 pm Adelaide, open calendar4 min read

This desk has not corrected this file. Corrections.

The paper

Comments

No notes on this story yet.

Sign in to comment