Selected events and fix thresholds
This retrospective covers 2026-09-01 to 2026-09-30. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.
For the selected items, this review confirms the disclosure or security release and its stated conditions. Active exploitation and historical CISA KEV or EPSS status are not asserted here. Missing exploitation evidence remains unknown.
| Event date | Product and advisory | Fix thresholds by branch |
|---|---|---|
| 2026-09-17 | WordPress | 7.1.1 |
| 2026-09-22 | WordPress | CVE-2026-87902 | 7.1.2 |
| 2026-09-29 | OpenSSL | CVE-2026-84783 | 4.0.3 |
| 2026-09-02 | curl | CVE-2026-19931 | 8.22.0 / 8.20.1 / 8.16.1 / 8.14.2 |
WordPress: the 7.1.1 security and maintenance release
WordPress 7.1.1 includes eleven security fixes. They cover several authorization and stored-XSS paths, including comments and editorial features. Some cases depend on a signed-in role or comment approval. Treat the release as a group of fixes with distinct access conditions.
Apply a supported release and verify the appropriate backport for older branches. Check comment approval, role permissions and editing behavior with test accounts.
WordPress: conditional local PHP inclusion (CVE-2026-87902)
Page-template resolution can include a readable local PHP file outside active-theme directories. The advisory requires a theme directory starting with page- and a suitable readable target file. Code execution additionally depends on the server environment; the vendor identifies 7.1.2 and individual branch backports as fixes.
Have the maintainer check the active parent and child themes and server configuration. Update core and test page-template selection and key landing pages; retain the specific backport version in the record.
OpenSSL: concurrent certificate-cache initialization (CVE-2026-84783)
OpenSSL 4.0 can free cached X.509 extensions while another thread still uses them during the first concurrent chain builds to the same trusted CA. This can crash a multithreaded TLS client or a server verifying client certificates. The advisory excludes OpenSSL 3.x from this issue.
Identify applications linked to OpenSSL 4.0 and whether certificate objects are shared across threads. Apply the fixed package and verify concurrent connection handling on a controlled environment.
curl: Negotiate identities in reused connections (CVE-2026-19931)
With Negotiate authentication and blank credentials, libcurl can reuse one user's authenticated connection for another user's request. The September advisory concerns connection identity in shared clients. The vendor lists 8.22.0 and maintenance-branch fixes.
Review shared clients that use operating-system Negotiate credentials. After updating, test two controlled accounts and confirm that their requests keep separate identities.
Breaches and cyber incidents reported this month
These cases were publicly reported during September 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.
| Organization | Public notice | Incident |
|---|---|---|
| Gyazo / Helpfeel | 2026-09-16 | Information exposure |
| Elekta | 2026-09-01 | Information exposure |
Gyazo: upload-server intrusion and image metadata (2026-09-16)
Helpfeel's 2026-09-16 notice described exploitation of Gyazo's upload server on September 11 and disclosure of user information and image metadata. Some metadata could enable access to images. The notice distinguished database records from people and reported no disclosure of payment-card information.
Review what screenshots and shared-image links reveal about your systems. Revoke exposed sharing links where possible, remove credentials from captures and check upload permissions and server isolation separately from the main website.
Elekta: business contact details extracted (2026-09-01)
On 2026-09-01, Elekta confirmed unauthorized access and extraction of information from part of its IT environment. Its assessment primarily identified customer business contact details, including names and work email addresses. The notice did not establish a breach of patient treatment records.
Keep customer contact data within the scope of access reviews even when it is commonly available elsewhere. Identify who can export it and how exposed contacts could be used to impersonate suppliers or redirect a business conversation.
Coverage and editorial record
This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.
The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.
