November 2026 security alerts: WordPress, Linux, Node.js and more

At a glance

Versions are the first fixed release. Anything newer is fine too.

WordPress: update to 7.1.4 now

On 28 October WordPress released version 7.1.4, a security release fixing several issues. One is a weakness in the upgrade process that can lead to remote code execution, meaning an attacker could run their own code on the web server, while a site is updating.

On 3 November the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw, CVE-2026-119977, to its list of vulnerabilities being used in real attacks. Security firm Wordfence reported blocking more than 13,000 attacks on it in a single day, according to BleepingComputer.

• Check your version. WordPress says “it is recommended that you update your sites immediately.” Sites with automatic background updates should update themselves, but log in and check the version under Dashboard › Updates.
• Older versions: WordPress is backporting the fixes to every older branch that still gets security fixes, back to 4.7, as they become ready. Update to the newest release for your version, or better still, move to 7.1.4.
• If updating has to wait, ask your host or developer about blocking web access to the wp-content/upgrade folder, which security researchers suggest as an interim step.
• Check for signs of a break-in: admin users you don’t recognise, new plugins you didn’t install, or unfamiliar files.

If you’re on our Website Care plan, applying updates like this is part of the service. If you’re not sure who updates your website, get in touch.

Linux: a critical TCP flaw, with the fix on its way

On 30 October Ireland’s National Cyber Security Centre (NCSC) published an advisory about CVE-2026-98432, a flaw in how the Linux kernel sets up new IPv4 TCP connections. It’s rated 9.8 out of 10. The NCSC says it affects Ubuntu, Red Hat Enterprise Linux and other Linux distributions, and can cause information disclosure, memory corruption or crashes.

Ubuntu rates it Critical and says it “can lead to remote code execution”. Researchers have built an exploit, but Ubuntu says it hasn’t been released yet and no others are known.

• Fixed kernels are in testing. On 2 November Ubuntu made fixes available in its “proposed” testing channel for Ubuntu 22.04, 24.04 and 26.04. They’ll move to the normal updates once testing is complete. Ubuntu hasn’t given a date.
• Install the fixed kernel as soon as it’s released, and reboot. Ubuntu says security updates are “the only appropriate mitigation”, rather than the workarounds suggested elsewhere. Server administrators who test kernels themselves can install the proposed kernels now; Ubuntu’s post explains how.
• Older Ubuntu versions: fixes for 20.04 and 18.04 will follow through Ubuntu Pro, which is free for up to five machines.
• Install this week’s kernel updates now. Ubuntu released kernel updates on 3 November that fix a long list of other kernel flaws. Like all kernel updates, they only take effect after a reboot.
• Other Linux systems: Red Hat and other vendors publish their own fixes. NAS drives, firewalls and routers often run Linux too, so watch for firmware updates from their makers.

Most websites run on Linux servers. On shared or managed hosting your host handles kernel updates, so ask them when they’ll install this fix. On your own server or VPS, it’s your job.

Node.js: updates on 11 November

The Node.js project announced on 3 November that it will release new versions of Node.js 22, 24 and 26 on or shortly after Wednesday 11 November. The most serious fix is rated high, and the details will be published with the release.

Node.js says end-of-life versions are always affected when a security release comes out, and they won’t be fixed. If an app still runs on Node.js 20 or older, plan its move to a supported version. This follows October’s Node.js release, which fixed ten flaws; see our October 2026 security patches guide.

Barracuda email gateways

On 3 November Barracuda warned of two flaws in its Email Security Gateway and several other Barracuda appliances: a critical authentication weakness (CVE-2026-116606) and a command injection flaw (CVE-2026-111560) that runs commands with full system access. Together they could give an attacker complete control of the device, BleepingComputer reports.

An attacker needs to reach the admin interface, and no attacks had been reported when Barracuda published its warning. Check that patch BNSF-40425 (version 9.4.017 and later) or BNSF-40430 (older versions) is installed, and that the admin interface isn’t open to the internet.

Other updates worth installing

• Progress WS_FTP Server: NCSC Ireland warned on 30 October of two critical flaws, rated 10 and 9.9 out of 10. The first lets an attacker read sensitive information, including administrator passwords, without logging in. The second allows command execution in some configurations. Update to 2024.0.7 or 2025.0.4, which fix both.
• Google Chrome 157: released on 3 November with 213 security fixes, seven of them critical, SecurityWeek reports. Google hasn’t reported any of them being exploited. Chrome updates itself, but it needs a restart to finish.
• Android: Google’s November security update fixes more than 200 flaws, including a critical one that could let an attacker run code without any action from the user. Install it when it reaches your phones.
• Ivanti Connect Secure VPN: CISA added two more Ivanti Connect Secure flaws to its exploited list on 30 October, SC Media reports. Researchers say attackers used them against devices that were fully patched at the time. Install Ivanti’s latest fixed release and follow its advisory, including checks for signs of compromise.
• cPGuard on hosting servers: attackers hijacked the automatic updates of OpsShield’s cPGuard security software on 2 November to install a backdoor, BleepingComputer reports. If your server uses it, follow OpsShield’s guidance and change the server’s passwords and keys.
• SonicWall Global Management System (GMS): two new flaws, but GMS has reached end of life and won’t be fixed. SonicWall advises moving to its Network Security Manager.
• Node-RED: a critical flaw (10 out of 10) is being exploited against Node-RED installations that can be reached from the internet. Never expose Node-RED to the internet, and make sure its admin login is switched on.
• Shops, restaurants and food businesses: NCSC Ireland issued a refrigeration security warning on 3 November. Make sure refrigeration controllers and other building systems can’t be reached from the internet.

Coming next week

• Tuesday 10 November: Microsoft’s monthly security updates for Windows and Office, which it releases on the second Tuesday of each month.
• Tuesday 10 November: Fortinet is due to publish the details of the FortiOS fixes it released in October. Once details are public, attacks often follow, so update any FortiGate that isn’t on a fixed version before then.
• Wednesday 11 November, or shortly after: the Node.js security releases.
• As soon as it’s released: the Linux kernel fix for the TCP flaw.

We’ll update this guide as each of these comes out.

This week’s checklist

1. Update every WordPress site to 7.1.4, or check that automatic updates did it, and look for admin users you don’t recognise.
2. Install this week’s Linux kernel updates on your servers and reboot, then watch for the TCP fix.
3. Restart Chrome on every PC and install the Android update on company phones.
4. If you use a Barracuda email gateway, WS_FTP Server or Ivanti Connect Secure, install the vendor’s fixes.
5. Make sure admin pages for firewalls, email gateways, Node-RED and building systems aren’t open to the internet.
6. Plan Windows updates for 10 November and Node.js updates for 11 November.