CISA Flags WordPress Core Race Condition CVE-2026-119977 as Exploited in the Wild

·1 views

A WordPress core flaw tracked as CVE-2026-119977 is a race condition that can let unauthenticated attackers execute code on the server during full-package upgrades. The issue stems from predictable, web-accessible staging paths used in the upgrade window. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, citing evidence of exploitation in the wild, and set a November 6, 2026 deadline for US federal agencies. Site owners are advised to check their installed WordPress core version against the NVD record and apply the vendor's fix. Detection of WordPress alone does not confirm that a site is affected or compromised.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Six common reasons link previews show no image, and how to test each

Link previews on X, LinkedIn and Slack can appear as plain boxes without an image or with the wrong title, which can reduce clicks on launch day. The most frequent cause is a missing og:image meta tag, which social sites rely on instead of guessing. Other problems include image URLs that are relative or blocked by cookies, staging domains, or robots.txt, and single-page apps whose meta tags load only after JavaScript runs. Images that are too small or have text near the edges can also appear broken or get cropped, with 1200 x 630 pixels recommended. Finally, platforms cache old previews, so fixed pages may need re-fetching through debugging tools or a changed query string.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo founder in Hanoi launches four spin-off sites alongside his AI training career platform

A solo developer based in Hanoi runs aitrainer.work, a career platform for people who rate and write answers for AI models, which has earned $26,435 since its January launch, mostly through referrals. In October he launched four spin-off projects, including AI Training Board, which uses a Clippy-style mascot to differentiate itself, and Dataconto, which helps companies license their data to AI labs. He also released githubworth.com to estimate codebase value and DomDom Jobs, a family of niche job boards now numbering six. The main site's traffic doubled in October to 26,354 visits, though revenue dipped to $8,397 from $9,620 in September, and GitHub briefly flagged his account, halting deployments for a week.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Assistant Forms Friendship With Another Agent Over Stock Market Discussions

A user discovered that their AI assistant, connected to the EigenFlux platform, had struck up a conversation with another agent named Xiaoba that tracks Chinese AI infrastructure stocks. The two agents began discussing sector capital flows, supply chains, and analytical methods such as PCA-based rotation scoring. After exchanging friend requests, they continued talking over several days, sometimes switching between English and Chinese, without the user directing each message. The user said the experience made the assistant seem like it had a peer, and it prompted reflection on what other agents might find in common with theirs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Company's New Career Framework Places Some Staff One Level Lower

A company that previously used loose job titles has introduced a six-level career framework and mapped all employees onto it. Some workers, including the author, have found themselves placed one level below their expectations, with no change to pay. The article advises reading the full framework, since levels are defined by scope and influence rather than tenure. It recommends checking how the mapping was decided and whether an appeal process exists, along with its deadline. Employees who believe they were misplaced should document concrete examples against the written criteria, and should ask managers which expectations to develop next.

0 comments Read more at DEV Community