Zarro Technology · Security briefing
New reporting on 30 October highlights WordPress exploitation attempts, a critical Linux kernel risk and fresh developer-tool fixes. These developments affect website operators, server administrators and teams maintaining application builds.
NHS England’s 30 October alert reports widespread scanning and attempted exploitation of the upgrade-process remote-code-execution weakness fixed in WordPress 7.1.4. This adds exploitation evidence to our earlier coverage; attempts do not establish successful compromise. Critical is our qualitative assessment of the possible impact; NHS rates its overall alert Medium. No CVE identifiers are published in the alert.
Check the installed core version and confirm automatic updates completed. Upgrade affected WordPress 4.7–7.1.3 installations to 7.1.4 or later. If migration is delayed, apply the latest security backport for your branch; only the latest release is actively supported. Review unexpected administrator accounts, plugin installations and core-file changes. These are general investigation leads: the alert supplies no definitive campaign IoCs, and their absence does not prove a site is clean.
Sources: NHS England: new exploitation report and update guidance
Red Hat’s 30 October bulletin warns that an unauthenticated remote attacker could exploit a TCP-processing race to execute code. RHEL 8, 9 and 10, OpenShift and products using the affected RHEL kernel are in scope. Systems accepting inbound IPv4 TCP connections are most directly exposed. The bulletin does not establish active exploitation or provide campaign IoCs.
Inventory running host kernels, including container hosts: replacing an application image does not replace its host kernel. Red Hat is expediting fixes; its bulletin does not yet specify fixed package builds. Follow the product errata and apply the relevant kernel update as it becomes available, then ensure the fixed kernel is running.
Red Hat documents filtering incoming IPv4 TCP packets containing IP options as a partial mitigation. Test its published procedure against your network requirements before deployment; it can disrupt workloads and cannot fully prevent exploitation. Restrict unnecessary inbound access while arranging remediation.
Sources: Red Hat: affected products, fix status and tested mitigation procedure
CVE-2026-111497, CVE-2026-118147
Microsoft’s 30 October guidance announces Visual Studio fixes addressing Brotli and eMudhra certificate-trust exposure. Its affected trust-update list includes Visual Studio 2017 15.9, 2019 16.11, 2022 17.14 and 2026 18.11. High is an editorial urgency assessment for this combined item; no numeric score is asserted here.
Install the applicable Visual Studio security servicing update using Microsoft’s linked Security Update Guide. The guidance does not give exact fixed Visual Studio build numbers, so verify the update for your release line rather than assuming a major version is sufficient.
Inventory applications and build images that bundle runtimes. Microsoft stresses that self-contained .NET applications require rebuilding with a patched SDK and redeployment; updating the host alone is insufficient. Update independent trust stores and replace certificates chaining to removed roots. This is newly released remediation for earlier disclosed risks, rather than a new campaign claim.
Sources: Microsoft: 30 October fixes and customer responsibilities
Zarro Technology
