WordPress unpacked update packages into a predictably named, web-served directory under wp-content/upgrade/. While an update was running, an unauthenticated attacker could reach the unpacked files and get a wp-config.php written into that directory copied over the site's configuration, which can lead to remote code execution. The fix gives the... Weiterlesen: Remote Code Execution via Race Condition in the WordPress Upgrade Wor…
Intelligence View
⚡ tsecurity.de Intelligence
Remote Code Execution via Race Condition in the WordPress Upgrade Working Directory
WordPress unpacked update packages into a predictably named, web-served directory under wp-content/upgrade/. While an update was running, an unauthenticated…
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!
🔍 CTI & Forensik
2
Cyber Threat Intelligence & Forensik
ATT&CK-Navigator · IoC-Radar · Exploit-Belege
MITRE ATT&CK Matrix Navigator
T1190TA0001 · Initial Access
Exploit Public-Facing Application
Mitigation: M1042 Network Segmentation & WAF Rule Enforcement
Quelle: Kontext-Klassifikation des Artikeltextes
Initial Access
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de
tsecurity.de Hub
Intelligence Digest — kostenlos Täglich die wichtigsten Security-News · jederzeit abbestellbar
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
★★★★★
Noch keine Leser-Bewertungen
War diese Seite hilfreich?
0
Powered by tsecurity.de
tsecurity.de Hub
Verwandte Story-Cluster & Quellen (Vektor-KI)
28 Quellen
CVE-2026-98432 Linux kernel IPv4 TCP flaw: status for CloudLinux
27 weitere Quellen
VVulDB Updatesvor 4 Std.CVE-2024-38625 | Linux Kernel up to 6.6.32/6.9.3 ntfs3 null pointer dereference (6c8054d59066/ff1068929459/1cd6c96219c4) VVulDB Updatesvor 4 Std.CVE-2024-38570 | Linux Kernel up to 6.6.32/6.8.11/6.9.2 gfs2 sd_dead_glocks use after free (Nessus ID 207818 / WID-SEC-2024-1418) VVulDB Updatesvor 4 Std.CVE-2024-36968 | Linux Kernel up to 6.6.31/6.8.10/6.9.1 Bluetooth l2cap_le_flowctl_init buffer overflow (Nessus ID 212722) VVulDB Updatesvor 4 Std.CVE-2024-36881 | Linux Kernel up to 6.6.30/6.8.9 userfaultfd close memory corruption (377f3a9a3d03/8d8b68a5b0c9/c88033efe9a3 / WID-SEC-2024-1259) VVulDB Updatesvor 4 Std.CVE-2024-27041 | Linux Kernel up to 6.6.22/6.7.10/6.8.1 amdgpu_dm_fini null pointer dereference (WID-SEC-2024-1008) VVulDB Updatesvor 4 Std.CVE-2023-52653 | Linux Kernel up to 6.6.22/6.7.10/6.8.1 SUNRPC gss_import_v2_context memory leak (Nessus ID 209785 / WID-SEC-2024-1008)
+21
14 Quellen
GitHub Release: google-ai-edge/LiteRT-LM v0.19.0 (30.10.2026)
13 weitere Quellen
GGitHubvor 1 Std.GitHub Release: matomo-org/matomo v6.1.0-alpha.20261030180418 (30.10.2026) GGitHubvor 1 Std.GitHub Release: openclaw/openclaw vrelease-publish/a3df6c6c8118-1793383326 (30.10.2026) GGitHubvor 1 Std.GitHub Release: openclaw/openclaw vrelease-publish/385f0d8eaaf1-1793384660 (30.10.2026) VVulDB Updatesvor 4 Std.CVE-2026-95274 | Google Chrome up to 153.0.8010.52 DevTools cross site scripting (WID-SEC-2026-3514) VVulDB Updatesvor 4 Std.CVE-2026-95275 | Google Chrome up to 153.0.8010.52 MediaStream privileges management (WID-SEC-2026-3514) VVulDB Updatesvor 4 Std.CVE-2026-95277 | Google Chrome up to 153.0.8010.52 Views use after free (WID-SEC-2026-3514)
+7
13 Quellen
Binance-Hack: Über 6 Milliarden Dollar gestohlen - IT-Administrator.de
12 weitere Quellen
NNYT > Technologyvor 1 Std.Binance’s $6.3 Billion Hack Is Just the Start of a Risky New Era GGoogle Alertvor 3 Std.Der Binance-Hack: Wie nordkoreanische Hacker die weltgrößte Kryptobörse bestahlen GGBHackers Securityvor 2 Std.North Korean Hackers Steal $6.36 Billion From Binance in Largest Crypto Hack Ever GGoogle Alertvor 2 Std.Nordkoreas Lazarus-Gruppe wahrscheinlich hinter dem 6-Milliarden-Dollar-Binance-Hack NNYT > Artificial Intelligen…vor 1 Std.Binance’s $6.3 Billion Hack Is Just the Start of a Risky New Era TThe CyberWirevor 3 Std.Binance suffers the largest crypto hack on record.
+6
Mehr aus dieser Kategorie
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
HAND-OFF
Auf Smartphone übergeben (ADVISORY)
Scannen Sie den QR-Code mit der Smartphone-Kamera für sofortigen mobilen Zugriff:
https://tsecurity.de/de/4307814/sichere-programmierung/remote-code-execution-via-race-condition-in-the-wordpress-upgrade-working-directory/