WordPress 7.1.4 came out on Oct 28 with fixes for 22 security problems, per Wordfence. The serious one is in the update process itself. While WordPress unpacks a full core update, it puts a temporary copy, including the installer, in a predictable folder under wp-content/upgrade. On many servers that folder can be reached from the web. An attacker who hits the installer in that window can end up running code on your server with no account.

Attackers are already watching. The window usually lasts only seconds, so a single attempt rarely works. That hasn't stopped anyone. Wordfence says its first blocked attempt came nine minutes after its firewall rule went live, and it logged more than 18,500 requests in the first 21 hours. Two sources kept polling small groups of sites for about 14.5 hours, which looks like waiting for an update to start. Wordfence has not reported a successful break-in, per SecurityWeek. No CVE number has been assigned yet.

Why small offices are exposed. Most small business sites run WordPress, and most rely on automatic updates nobody checks. That's fine until the update itself is the risk.

Action item: Confirm the version, then close the folder.
1. Check the version. Log in and go to Dashboard > Updates. You want 7.1.4, or the newest security release on your branch (fixes go back to 4.7). Wordfence says don't assume the auto-update finished.
2. Block the staging folder. Ask your web host or developer to deny web access to wp-content/upgrade/. This is a one-line server rule, and it helps for every future update too.
3. If you were slow to update, look around. heise lists the warning signs: unexpected PHP files under wp-content/upgrade, admin accounts you don't recognize, and plugins or files nobody added.

Second item: Patch Veeam Backup & Replication 13. Veeam fixed CVE-2026-108142, a critical flaw (9.1) that lets an attacker with no login get past authorization on its CDP Coordinator Service, per Veeam KB4948. Veeam hasn't said it's been used in attacks. Version 12 isn't affected. Backup servers are one of the first things ransomware crews go after, because wiping your backups is how they make you pay.
• If you run Veeam 13: upgrade to 13.1.2 (build 13.1.2.57) or 13.0.3 (build 13.0.3.63). Update managed Linux agents to 13.1.2.11.
• Everyone with backups: keep at least one copy that's offline or can't be changed. A backup server that can be reached can be wiped.

Also today

Ivanti VPN owners, you may not be done. CISA added two more Ivanti Connect Secure flaws (CVE-2026-111357 and CVE-2026-118527) to its exploited list on Oct 30. The fix for the final step of the October attack only shipped Oct 29, so a mid-October patch isn't enough. You need 22.8R2.6 or 25.1.1.3, per Ivanti's advisory.

Yesterday's warning still applies. Expect fake "Binance support" calls and refund emails. The steps are in yesterday's briefing.