WordPress exploitation is confirmed, and stolen app secrets are opening cloud tenants— where does the urgent work start? This is Lantern Cybersecurity Daily. WordPress, cloud access, hacked switches—and a cyberattack disrupting blood storage refrigeration in France. We'll start with WordPress: who's exposed? One tap on follow, and we'll be back in your ears before you know it.
Here's BleepingComputer:
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. Tracked as CVE-2026-119977, this high-severity WordPress Core flaw stems from a Time-of-check Time-of-use (TOCTOU) race condition and was reported by Picus Security researcher Umut Bayram.
If your team runs WordPress, this deserves an interruption: CISA says attackers are exploiting a core flaw that can let outsiders run code on the server without an account. WordPress released the fix in version 7.1.4 on October 28. The vulnerable moment is during a full-package core upgrade, when predictable, web-accessible staging paths create an opening. Exploitation is described as high-complexity, but CISA has confirmed it's happening—so that difficulty shouldn't buy anyone much reassurance. Wordfence also reported blocking 13,095 attempts in a 24-hour period. Don't turn that into 13,095 hacked sites; blocked attempts and successful compromises are very different counts. Federal civilian agencies have until Friday, November 6, to secure affected systems. For everyone else, CISA also urges priority patching: check your deployed WordPress version and apply the security update. The flaw is CVE-2026-119977.
Todyl, with Andrew Scott:
Since November 1, one operator has been signing in to MSPs' Microsoft 365 and Azure environments as their own applications, using stolen credentials that are still valid. About 45 app registrations at roughly 18 organizations were targeted, and more than 33 of them authenticated successfully. Through those apps the actor has reached 27 organizations so far, including the MSPs' downstream clients in government, energy, food and agriculture, transportation, construction and engineering, legal, education and nonprofits.
For managed service providers running Microsoft 365 and Azure, Todyl reports an intruder using stolen application credentials that still work. No Microsoft software flaw to patch here—the attacker can sign in as the software. And the exposure reaches those providers' customers. Todyl reports access to 27 organizations, including government and energy clients, with 81 files downloaded and roughly 2,279 mailbox items accessed. Those counts cover only organizations sending Todyl logs, so they're a floor. The detail that earns an interruption: about two and a half minutes between downloading a connector archive and signing in as that connector's application. I'd prioritize checking which app secrets those archives contain and what those identities can reach. Yes—and revoking stolen credentials alongside checking that access. Todyl's evidence points to one operator expanding access with harvested secrets, not a self-spreading worm. For an affected provider, the response has to account for downstream customers, too.
From BleepingComputer:
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and steal configuration files and credentials. The vulnerability, tracked as CVE-2026-107441, is an out-of-bounds write flaw in the switches' web management interface that allows an unauthenticated attacker with network access to execute operating system commands using specially crafted HTTP requests.
If your team runs Zyxel GS1900 switches, check the October 22 security updates—even if you patched in June. Attackers compromised 996 devices across 48 countries, according to GreyNoise, and the exploit was initially pinned on the wrong vulnerability. That's a consequential correction. Binarly found a separate, previously unknown flaw in the web management interface: an attacker who can reach it can run operating-system commands without logging in. A June patch wasn't protection against this bug. So a team could have done the assigned homework and still been exposed. CISA's September listing named the older flaw; for this one, match your model against Zyxel's November 3 advisory—ten GS1900 models are affected. And for compromised switches, installing the fix doesn't retrieve stolen data. GreyNoise says the attackers collected configurations, hashed root credentials, and network information. Review affected credentials and management access alongside patching; the theft makes this more than a firmware task.
From Sergiu Gatlan at BleepingComputer:
France's national blood service has confirmed that a cyberattack targeting a refrigeration equipment provider raised temperature and defrost settings at three of its facilities, threatening stored blood products. The French Blood Establishment (Établissement français du sang or EFS), which manages blood collection, processing, and distribution across France, said the incident occurred on November 2 and affected systems used to monitor and control cold-storage chambers.
Blood products stored for French hospitals were put at risk when a cyberattack raised refrigeration settings at three national blood-service facilities on November second. The service, EFS, says alarms caught the changes, staff intervened, and no blood-product losses or health impact have been reported. Those alarms—and staff able to fix equipment or move the stock—deserve the attention here. Attackers changed temperature and defrost thresholds to extremely high levels; the recovery plan had to work while the refrigerators were still holding blood. EFS says its refrigeration supplier was targeted, but hasn't named that supplier. Separately, Coolworld Rentals confirms an incident involving remote-monitoring software and blames a third-party component. Calling that component outside its direct control still leaves customers needing an explanation of how refrigeration settings were protected. For a small facilities team, I'd start with the supplier connection: can remote access change those thresholds, and will an alarm still reach staff if that connection fails? EFS's reported outcome gives you a concrete reason to test the fallback.
Have feedback, a story idea, or a correction? Email us at lanterncybersecuritydaily at lantern podcasts dot com. Your notes help us make Lantern Cybersecurity Daily more useful.
Looking ahead, Friday is CISA’s deadline for Federal Civilian Executive Branch agencies to address the actively exploited WordPress flaw CVE-2026-119977. Links to every story we covered are in the show notes, so take a look at the pieces that caught your attention. That’s Lantern Cybersecurity Daily for today. We’ll be back tomorrow. This is a Lantern Podcast.