[{"data":1,"prerenderedAt":222},["ShallowReactive",2],{"publication:en:D202609":3},{"meta":4,"copy":18,"relatedArticles":177,"terms":214,"term":215,"resourceParent":216,"glossaryParent":219},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"D202609","\u002Fblog\u002Fvulnerability-digest-2026-09","article","Website vulnerability digest for September 2026","Cybersecurity digest for September 2026","September 2026: vulnerabilities, breaches and cyber incidents","September 2026 security digest: software vulnerabilities, incidents involving Gyazo \u002F Helpfeel and Elekta, sources and practical checks for businesses.",[13,14,15],"\u002Fblog","\u002Fblog\u002Fvulnerability-digest-2026-08","\u002Fblog\u002Fvulnerability-digest-2026-10","2026-10-03","2026-11-06",{"intro":19,"sections":20,"checklistTitle":135,"checklist":136,"faq":139,"sources":149,"links":159,"cta":172},"September brought two WordPress security releases, an OpenSSL 4.0 certificate-cache fix and a curl connection-identity correction. A second WordPress release followed the first within the month. Confirm the later applicable fixes and test both public pages and authenticated integrations. The issue also covers incidents involving Gyazo \u002F Helpfeel and Elekta, with the reported impact and checks relevant to a business using similar services.",[21,49,58,73,82,94,112,121,130],{"title":22,"paragraphs":23,"table":26},"Selected events and fix thresholds",[24,25],"This retrospective covers 2026-09-01 to 2026-09-30. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.","For the selected items, this review confirms the disclosure or security release and its stated conditions. Active exploitation and historical CISA KEV or EPSS status are not asserted here. Missing exploitation evidence remains unknown.",{"caption":27,"headers":28,"rows":32},"Selected disclosures and security releases for September 2026",[29,30,31],"Event date","Product and advisory","Fix thresholds by branch",[33,37,41,45],[34,35,36],"2026-09-17","WordPress","7.1.1",[38,39,40],"2026-09-22","WordPress | CVE-2026-87902","7.1.2",[42,43,44],"2026-09-29","OpenSSL | CVE-2026-84783","4.0.3",[46,47,48],"2026-09-02","curl | CVE-2026-19931","8.22.0 \u002F 8.20.1 \u002F 8.16.1 \u002F 8.14.2",{"title":50,"paragraphs":51,"sources":54},"WordPress: the 7.1.1 security and maintenance release",[52,53],"WordPress 7.1.1 includes eleven security fixes. They cover several authorization and stored-XSS paths, including comments and editorial features. Some cases depend on a signed-in role or comment approval. Treat the release as a group of fixes with distinct access conditions.","Apply a supported release and verify the appropriate backport for older branches. Check comment approval, role permissions and editing behavior with test accounts.",[55],{"label":56,"url":57},"wordpress 7 1 1 maintenance and security release","https:\u002F\u002Fwordpress.org\u002Fnews\u002F2026\u002F09\u002Fwordpress-7-1-1-maintenance-and-security-release\u002F",{"title":59,"paragraphs":60,"sources":63},"WordPress: conditional local PHP inclusion (CVE-2026-87902)",[61,62],"Page-template resolution can include a readable local PHP file outside active-theme directories. The advisory requires a theme directory starting with page- and a suitable readable target file. Code execution additionally depends on the server environment; the vendor identifies 7.1.2 and individual branch backports as fixes.","Have the maintainer check the active parent and child themes and server configuration. Update core and test page-template selection and key landing pages; retain the specific backport version in the record.",[64,67,70],{"label":65,"url":66},"wordpress 7 1 2 release","https:\u002F\u002Fwordpress.org\u002Fnews\u002F2026\u002F09\u002Fwordpress-7-1-2-release\u002F",{"label":68,"url":69},"CVE-2026-87902 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-87902",{"label":71,"url":72},"WordPress advisory GHSA-7hp8-65ch-5whp","https:\u002F\u002Fgithub.com\u002FWordPress\u002Fwordpress-develop\u002Fsecurity\u002Fadvisories\u002FGHSA-7hp8-65ch-5whp",{"title":74,"paragraphs":75,"sources":78},"OpenSSL: concurrent certificate-cache initialization (CVE-2026-84783)",[76,77],"OpenSSL 4.0 can free cached X.509 extensions while another thread still uses them during the first concurrent chain builds to the same trusted CA. This can crash a multithreaded TLS client or a server verifying client certificates. The advisory excludes OpenSSL 3.x from this issue.","Identify applications linked to OpenSSL 4.0 and whether certificate objects are shared across threads. Apply the fixed package and verify concurrent connection handling on a controlled environment.",[79],{"label":80,"url":81},"CVE-2026-84783 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-84783",{"title":83,"paragraphs":84,"sources":87},"curl: Negotiate identities in reused connections (CVE-2026-19931)",[85,86],"With Negotiate authentication and blank credentials, libcurl can reuse one user's authenticated connection for another user's request. The September advisory concerns connection identity in shared clients. The vendor lists 8.22.0 and maintenance-branch fixes.","Review shared clients that use operating-system Negotiate credentials. After updating, test two controlled accounts and confirm that their requests keep separate identities.",[88,91],{"label":89,"url":90},"curl advisory CVE-2026-19931","https:\u002F\u002Fcurl.se\u002Fdocs\u002FCVE-2026-19931.html",{"label":92,"url":93},"CVE-2026-19931 | CNA record","https:\u002F\u002Fcveawg.mitre.org\u002Fapi\u002Fcve\u002FCVE-2026-19931",{"title":95,"paragraphs":96,"table":98},"Breaches and cyber incidents reported this month",[97],"These cases were publicly reported during September 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.",{"caption":99,"headers":100,"rows":104},"Incident notices: September 2026",[101,102,103],"Organization","Public notice","Incident",[105,109],[106,107,108],"Gyazo \u002F Helpfeel","2026-09-16","Information exposure",[110,111,108],"Elekta","2026-09-01",{"title":113,"paragraphs":114,"sources":117},"Gyazo: upload-server intrusion and image metadata (2026-09-16)",[115,116],"Helpfeel's 2026-09-16 notice described exploitation of Gyazo's upload server on September 11 and disclosure of user information and image metadata. Some metadata could enable access to images. The notice distinguished database records from people and reported no disclosure of payment-card information.","Review what screenshots and shared-image links reveal about your systems. Revoke exposed sharing links where possible, remove credentials from captures and check upload permissions and server isolation separately from the main website.",[118],{"label":119,"url":120},"Helpfeel: incident notice","https:\u002F\u002Fcorp.helpfeel.com\u002Fen\u002Fnews\u002Fnews-20260916",{"title":122,"paragraphs":123,"sources":126},"Elekta: business contact details extracted (2026-09-01)",[124,125],"On 2026-09-01, Elekta confirmed unauthorized access and extraction of information from part of its IT environment. Its assessment primarily identified customer business contact details, including names and work email addresses. The notice did not establish a breach of patient treatment records.","Keep customer contact data within the scope of access reviews even when it is commonly available elsewhere. Identify who can export it and how exposed contacts could be used to impersonate suppliers or redirect a business conversation.",[127],{"label":128,"url":129},"Elekta: incident notice","https:\u002F\u002Fwww.elekta.com\u002Fcybersecurity-incident\u002F",{"title":131,"paragraphs":132},"Coverage and editorial record",[133,134],"This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.","The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.","Checks to assign to the maintainer",[53,62,77,86,137,138],"Record the installed package or image, the applicable condition and the person responsible for the change.","Agree backup, restart and rollback steps, then check enquiries, login and affected integrations using controlled data.",[140,143,146],{"question":141,"answer":142},"Should we install the old version listed in the table?","The numbers identify the historical fix in each branch. Select a release that is supported at deployment time, or a distributor package whose security notice confirms the backport. Record the actual installed revision.",{"question":144,"answer":145},"Does an update prove that a site was never compromised?","An update closes the affected software path. If logs, accounts or files show suspicious changes, investigate that evidence separately and verify recovery. A successful update alone does not resolve an incident.",{"question":147,"answer":148},"Why can the date of an attack differ from the digest month?","This section groups public notices by the month in which they were issued. The text states an earlier discovery date when the source provides one. A later investigation or a newly released old database is not silently presented as a new attack.",[150,151,152,153,154,155,156,157,158],{"label":56,"url":57},{"label":65,"url":66},{"label":68,"url":69},{"label":71,"url":72},{"label":80,"url":81},{"label":89,"url":90},{"label":92,"url":93},{"label":119,"url":120},{"label":128,"url":129},[160,162,164,167,170],{"path":14,"label":161},"Previous issue: August 2026",{"path":15,"label":163},"Next issue: October 2026",{"path":165,"label":166},"\u002Fblog\u002Fvulnerability-prioritization","How to prioritize vulnerabilities",{"path":168,"label":169},"\u002Fservices\u002Fsecurity-audit","Plan a website security review",{"path":13,"label":171},"All articles",{"title":173,"description":174,"button":175,"type":176},"Check which updates apply to your website","Send the website URL and the hosting or application details you know. We will agree applicability, the maintenance scope and checks after the change.","Discuss the update scope","check",[178,190,199,207],{"id":179,"path":14,"title":180,"description":181,"category":182,"artwork":183,"order":184,"publishedOn":185,"period":186,"related":187},"D202608","Cybersecurity digest for August 2026","August 2026 security digest: software vulnerabilities, incidents involving Chubu Electric Power and SickKids, sources and practical checks for businesses.","digest","vulnerability-digest",3,"2026-09-03","2026-08",[188,6,165,189],"\u002Fblog\u002Fvulnerability-digest-2026-07","\u002Fblog\u002Fwhy-website-updates-matter",{"id":191,"path":15,"title":192,"description":193,"category":182,"artwork":183,"order":194,"publishedOn":195,"period":196,"related":197},"D202610","Cybersecurity digest for October 2026","October 2026 security digest: software vulnerabilities, incidents involving Capcom \u002F CAPCOM ID and ASOS, sources and practical checks for businesses.",1,"2026-11-03","2026-10",[6,165,198,189],"\u002Fblog\u002Fwordpress-plugin-vulnerability-response",{"id":200,"path":165,"title":201,"description":202,"category":203,"artwork":204,"order":205,"publishedOn":206},"P083","Vulnerability prioritization for small business: decide what to fix first","Prioritize vulnerabilities by applicability, exposure, exploitation evidence, business impact and repair. Record an owner, decision and acceptance check.","operations","security",82,"2026-10-22",{"id":208,"path":189,"title":209,"description":210,"category":211,"artwork":211,"order":212,"publishedOn":213},"updates","How to Update WordPress Safely","To update WordPress safely, check theme, plugin and PHP compatibility, back up files and the database, and prepare a recovery procedure before changing versions. After the update, test login, forms and checkout. Pause when a critical dependency is incompatible or recovery has not been prepared.","websites",107,"2026-04-21",[],null,{"path":217,"label":218},"\u002Fresources","Website security resources and templates",{"path":220,"label":221},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058206]