Security briefings tagged with PHP
CISA lists the original two flaws as known exploited. The separate session upload progress flaw was not in CISA's catalog on November 9.
Update the PHP runtime using the vendor advisory, and assess CVE-2026-115560 separately. Ask your hosting provider to confirm fixes if it manages PHP.
最終確認日：
CVE-2026-60137 · CVE-2026-63030
Two related WordPress flaws can expose database contents and allow unauthenticated code execution through distinct SQL-injection and REST API attack paths.
Affected sites can be compromised before sign-in. The July 20 review did not confirm active exploitation.
Check each site's WordPress version and apply the vendor's update or backport guidance. Keep compensating controls in place during remediation.