This week's thread is the software teams host for themselves. A WordPress core bug that strikes while a site is updating is being exploited, a critical GitLab flaw joined the list of attacked vulnerabilities and turned out to come from Ruby's regular expression engine, and exposed Node-RED editors are being taken over automatically.
There is also a Next.js release that fixes data leaking between tenants, and a Node.js security release to plan for on 11 November.
WordPress: a flaw in the upgrade itself
On 3 November CISA added CVE-2026-119977 (CVSS 8.1) to its catalogue of actively exploited vulnerabilities. It is in WordPress core, not in a plugin. During a full core upgrade, WordPress unpacks the new release into staging paths that are predictable and reachable from the web. An attacker who requests the right path at the right moment can run code on the server without logging in.
The window is short, which is why the score is not higher, but every site that updates opens it. The bug affects every version from 4.7 through 7.1.3.
WordPress 7.1.4, released on 28 October, fixes it along with several stored cross-site scripting issues, and the fix is backported to every branch back to 4.7. On the 7.0 branch it is fixed in 7.0.8.
What to do:
- Check the version each site actually reports in Dashboard > Updates. Most sites get security releases through automatic background updates, but do not assume one ran.
- If a site was not on a fixed version by the end of October, look for PHP
files in the web root that you did not put there, and rotate the database
password and keys in
wp-config.php.
This applies wherever WordPress runs, on Cosmoner web hosting or anywhere else.
GitLab is being attacked, and the bug is in Ruby
CISA added GitLab's CVE-2026-97229 (CVSS 10.0) to its exploited list on 29 October. A crafted regular expression in a CI/CD configuration lets an unauthenticated attacker run code on a self-managed GitLab server. GitLab fixed it on 12 October in 19.4.2, 19.3.5 and 19.2.8.
That was not the last of it. On 21 October GitLab shipped a second critical release for a related bug, CVE-2026-110264 (CVSS 10.0), which affects versions as old as 7.0. The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13. If you patched on 12 October and stopped there, you are still exposed.
Both bugs are in Onigmo, the regular expression engine inside Ruby itself.
The Ruby project's notice
says a crafted pattern can corrupt memory while it is being compiled, and that
Regexp.timeout and length limits do not reliably protect you. That matters
beyond GitLab:
- If you run GitLab, upgrade to one of the 21 October versions. The official Linux packages and container images include the fixed Ruby. Source installs that use their own Ruby must upgrade Ruby too.
- If you write Ruby, the risk is any code that builds a regular expression
from user input:
Regexp.new,Regexp.union,Regexp.compile, or interpolating a string into a regexp literal. Upgrade to Ruby 4.0.9, 3.4.12 or 3.3.13, which contain all the fixes, then rebuild and redeploy. Until you can, stop compiling patterns from untrusted input.
Next.js: cached data can cross between tenants
The Next.js November security release came out on 3 November, fixing seven issues in 16.4.5 and 15.5.29.
The one rated high affects apps with Cache Components enabled. When the same
use cache function is called both directly and from inside unstable_cache,
and it reads a root parameter such as a tenant identifier, a cold cache fill can
hand one tenant's result to another. Two of the medium issues are variations
on the same theme: cached content reused across root parameters or across
users.
The others matter mostly when you run next start yourself:
- Edge route handlers that set cookies with
NextResponse.cookies.set()could expose them, includingHttpOnlyones, in an internal response header that same-origin JavaScript can read. - A shared page shell could be poisoned by an unauthenticated request in some route shapes.
- An image could slip past
images.dangerouslyAllowSVG: falseby posing as AVIF.
If your app is multi-tenant and uses use cache, treat this as urgent.
Otherwise, update on your normal schedule. Either way, update next in your
lockfile and redeploy.
Exposed Node-RED editors are being taken over
Node-RED is a popular low-code tool for automations and IoT. VulnCheck
reported on 2 November
that attackers have been exploiting it since 30 October, deploying flows that
download and run a Linux bot or leave a web shell behind. The CVE involved,
CVE-2026-58115 (CVSS 10.0), was filed for Siemens devices that ship Node-RED
without authentication. VulnCheck says any Node-RED instance without
adminAuth is being found and exploited automatically, because deploying a
flow takes a single HTTP request.
If you run Node-RED anywhere, make sure the editor is not reachable from the
internet without a login. Turn on adminAuth in settings.js, or put the
editor behind a VPN or an authenticating proxy. Then review your deployed flows
for exec nodes or HTTP endpoints you did not create.
Node.js: a security release on 11 November
The Node.js project has announced security releases for the 26.x, 24.x and 22.x lines, due on or shortly after Wednesday 11 November. The most severe issue in each line is rated high. Details come out with the release.
This follows October's release, which fixed the exploited Brotli bug covered in our last issue. Release lines that have reached end of life are affected too and will get no fix. If you are on one, moving to 24 or 26 before next week makes the update a routine one.
On Cosmoner this week
- New accounts get USD 5.00 of credit on their first project when they save a card.