3 newly exploited flaws this week, 2 of them zero-days (attacked before or as the fix came out). Here's what to patch first.
Patch these first
- WordPress Core (zero-day, internet-facing)
WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. - SonicWall SonicOS SSLVPN (zero-day, internet-facing)
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent. - Apple Multiple Products
Apple Multiple Products Improper Authentication Vulnerability
What to do: Install the vendor's security update. If there isn't one yet, apply the vendor's workaround, or stop using the product until it's fixed. CISA lists this as actively exploited, so treat it as urgent.
CISA deadlines this week
- Nov 10, 2026: Adobe Commerce / Magento
- Nov 10, 2026: Brotli / Node.js
- Nov 11, 2026: Broadcom VMware ESX
- Nov 12, 2026: IBM Aspera Faspex
- Nov 12, 2026: OpenBSD OpenSSH
- Nov 12, 2026: SignalWire FreeSwitch
- Nov 12, 2026: GPUStack
- Nov 13, 2026: Ivanti Connect Secure
Only care about the tech you run? Pick your products on patchsonar.com to filter the list, print a one-page brief, or get alerts in Slack, Teams or Discord.
Forward this to whoever handles your updates. Got it from a friend? Subscribe free.
General information only, not professional advice. Confirm version numbers with the vendor before you update.