Friday, 06 November 2026
A catch-up edition for 2 to 6 Nov. CISA added a WordPress core upgrade-window RCE (CVE-2026-119977, due today) and an Apple pointer authentication bypass to KEV. Kubernetes published a low-severity ingress-nginx CVE, and AWS added an EC2 IMDSv1 metric, Security Hub SBOM inventory and CRL checking for IAM Roles Anywhere.
Added on 3 Nov. A time-of-check time-of-use race condition could let unauthenticated attackers execute code on the server during the upgrade window, because full-package core upgrades use predictable, web-accessible staging paths. The federal due date is 6 Nov, which is today. Check that your sites are on the fixed WordPress release and look at your auto-update status.
Added on 4 Nov. An improper authentication flaw in iOS, iPadOS, macOS, Safari, tvOS and watchOS that could let an attacker who already has arbitrary read and write capability bypass pointer authentication. Keep Apple devices updated.
Published 5 Nov. Only clusters using ingress-nginx are affected. A user who can create Ingresses can use the mirror-target annotation, because of a missing check, to reach an unauthenticated configuration API inside the controller and submit write commands. Corrupting that data drops all traffic through ingress-nginx until an Ingress change or a controller restart recreates it. Check the linked issue for the fixed version and restrict who can create Ingress objects.
Announced 5 Nov. You can see which of your EC2 instances still have Instance Metadata Service Version 1 (IMDSv1) enabled, which helps when you are moving everything to IMDSv2.
Announced 6 Nov. Central security teams get a continuously updated, organization-wide view of the software packages running on compute resources.
Announced 5 Nov. IAM Roles Anywhere can now check revocation automatically using certificate revocation list (CRL) distribution points (CDPs) in your certificates.