1. Cisco ASA and FTD: exploited SSL VPN disruption (High)

CVE-2026-76418 (8.6)

Impact and exploitation

Cisco confirms active exploitation. An unauthenticated attacker can trigger an unexpected reload of affected ASA or FTD devices, disrupting remote access. Exposure requires reachable SSL remote-access VPN and the relevant secondary-authentication tunnel-group configuration; successful VPN login is not required.

Checks and IoCs

Review deployed software and VPN policy against Cisco’s advisory. Check all relevant tunnel groups, including DefaultWEBVPNGroup, for secondary authentication. Unexpected reloads and correlated VPN connection activity are investigation leads, not definitive IoCs; the advisory supplies no campaign-specific IPs or hashes.

Remediation

Use Cisco’s Software Checker and fixed-release table for your train. Examples include ASA 9.20.4.50 or 9.22.3.200, and FTD 7.4.9 or 7.6.7. Other branches have different fixes. Upgrade through your supported procedure. Cisco describes temporary configuration mitigations but warns that removing secondary authentication can lower security; do not disable authentication controls as a routine substitute for patching.

Sources: Cisco advisory, configuration checks and fixed releases

2. WordPress: core security update (Critical)

Impact

WordPress released 7.1.4 on 28 October. Fixes include a race condition during core updates that could lead to remote code execution, stored cross-site scripting, information disclosure and permissions weaknesses. The Critical label is an editorial assessment of potential code execution; the cited WordPress notices do not assign numeric CVSS scores or map these fixes to CVE identifiers.

Checks and remediation

Check the actual core version across every site, including staging and multisite installations. Update through Dashboard → Updates or the supported management process, and confirm completion rather than assuming automatic updates ran. Take a recoverable backup and check site functionality after deployment.

The supported current release is 7.1.4. WordPress also lists courtesy fixes for older branches, including 7.0.8, 6.9.11, 6.8.12 and 6.7.11; these are not a replacement for planning migration to the actively supported release.

Checks and IoCs

The notices do not establish active exploitation or publish campaign-specific IoCs. Investigate unexplained core-file changes, unexpected administrative activity and injected content using existing monitoring. Those signs are general leads, not proof of exploitation of these particular fixes.

Sources: WordPress security announcement · Affected branches and release documentation