Update your WordPress site to 7.1.2

The stage door was propped open. Somebody noticed.

Is this you?

• The flaw is CVE-2026-87902, fixed in WordPress 7.1.2 on 22 September. Under certain server and theme settings, a visitor with no account can make WordPress load a file it should never load, and from there take over the server.
• The Dutch national cyber centre (NCSC) reported on 24 September that public sources have seen it being used. It adds that the attack needs specific conditions and depends heavily on how each site is set up. So not every site is open, and nobody can tell you from the outside that yours is not.
• Five days earlier, version 7.1.1 fixed eleven other problems. One of them, nicknamed Click2Shell, takes over the site when a logged-in administrator clicks a booby-trapped link. The Belgian cyber centre (CCB) published a "patch immediately" warning on 23 September.

CCB warning: WordPress Click2Shell and Comment2Shell, patch immediately (23 Sep 2026) → https://ccb.belgium.be/advisories/warning-click2shell-and-comment2shell-vulnerabilities-wordpress-can-lead-remote-code

The list I asked you for last week

— Patch, your friendly house bot

The WordPress fix above only helps if you know you run WordPress, and which version. Now ask the same question about the laptops in your office.

Real invoice, wrong bank account

Same costume, different actor.

Tell whoever pays your invoices:

• It only works when someone is already inside a mailbox. Safeonweb says it plainly: "This can only happen if fraudsters have access to your inbox." Yours or your supplier's.
• The tells are small. An account number your banking app does not recognise, an invoice you cannot find in the supplier's own portal, or a number in a slightly different font or layout.
• Listen to your bank's name check. If it warns that the name does not match the account number, stop and check. Safeonweb's advice is not to click past that warning.

Safeonweb: received an invoice by email? Check the account number before you pay (23 Sep 2026) → https://safeonweb.be/en/news/ave-you-received-invoice-email-check-account-number-you-pay

Last week's firewall hole is now in use

The understudy went on after all.

• Check Point, CVE-2026-85102 (9.8 out of 10). It lets someone run their own code on the firewall through its VPN, without a password. Fixes have been out since 9 September. On 22 September Check Point wrote: "We are now observing exploitation attempts against Check Point Spark customers globally." A second flaw in its management server, CVE-2026-93616, is also being used, and the CCB warned about it on 23 September.
• Synology NAS, two flaws scoring 9.8 each. The CCB warned on 21 September. Nobody has been seen using them yet, which is the best time to update DSM to 7.4-90075 or the fixed build for your version.
• ConnectWise ScreenConnect, CVE-2026-84869 (9.9). The remote-support tool could move files onto a supported computer and run them without the user saying yes. Fixed on 8 September, confirmed in use by the US agency CISA on 11 September. Ask whoever remotes into your machines whether theirs is updated.

CCB warning: actively exploited Check Point CVE-2026-93616 (23 Sep 2026) → https://ccb.belgium.be/advisories/warning-actively-exploited-critical-cve-2026-93616-enables-unauthenticated-arbitrary

How easy is it to get into your mailbox?

Who else has a key to the stage door?

Try it:

• Two-step sign-in: whether every user has to use it, whether administrators have to, and whether those administrators have actually set it up.
• Old back doors: whether the older sign-in methods that skip two-step verification are blocked.
• Weak codes: whether codes by text message, phone call or email are still allowed. A code sent to a phone number can be intercepted by taking over the number.

Try it now → https://easycyberprotection.com/start