{"id":2862,"date":"2026-07-18T02:36:16","date_gmt":"2026-07-18T02:36:16","guid":{"rendered":"https:\/\/quicknewsnigeria.com\/?p=2862"},"modified":"2026-07-18T02:36:16","modified_gmt":"2026-07-18T02:36:16","slug":"matt-important-security-update","status":"publish","type":"post","link":"https:\/\/quicknewsnigeria.com\/?p=2862","title":{"rendered":"Matt: Important Security Update"},"content":{"rendered":"<p class=\"wp-block-paragraph\"><a href=\"https:\/\/wordpress.org\/news\/2026\/07\/wordpress-7-0-2-release\/\">WordPress 7.0.2<\/a> went out today with two important security updates. One is a type of pre-authorization RCE we (fortunately!) have only seen a few times in WordPress\u2019 23-year history; the last, I believe, <a href=\"https:\/\/wordpress.org\/documentation\/wordpress-version\/version-4-6-21\/\">in the PHPMailer class five years ago<\/a>. <\/p>\n<p class=\"wp-block-paragraph\">Major kudos to <a href=\"https:\/\/x.com\/hash_kitten\">Adam Kues<\/a> of <a href=\"https:\/\/slcyber.io\/\">Searchlight Cyber<\/a> for finding the batch REST API RCE, to TF1T, dtro, and haongo on the facilitated SQL injection! <\/p>\n<p class=\"wp-block-paragraph\">Thanks to <a href=\"https:\/\/en.wikipedia.org\/wiki\/Coordinated_vulnerability_disclosure\">responsible disclosure<\/a>, the WordPress.org Security team was able to coordinate with hosts and CDNs to mitigate the attack at the network layer. <em>Please upgrade anyway!<\/em> But it\u2019s a huge relief to know the vast majority of WordPress sites were protected by <a href=\"https:\/\/en.wikipedia.org\/wiki\/Defense_in_depth_(computing)\">defense-in-depth<\/a> even before the updates went out. <\/p>\n<p class=\"wp-block-paragraph\">I really appreciate how people and organizations that otherwise might not be on the best of terms come together in times like this. (<a href=\"https:\/\/wordpress.org\/news\/2026\/07\/wordpress-7-0-2-release\/\">Full credits in the release post<\/a>.) Everyone buries the hatchet to protect as many people as possible as quickly as possible.<\/p>\n<p class=\"wp-block-paragraph\">I\u2019ve said it before, I\u2019ll say it again: security is going to be a big topic this year as the technology industry digests the incredible advances in AI models. It\u2019s a good time to review your plans and processes, sweat the details, <a href=\"https:\/\/www.amazon.com\/dp\/1953953492\">invest in maintenance<\/a>, and <a href=\"https:\/\/en.wikipedia.org\/wiki\/System_Administrator_Appreciation_Day\">hug a sysadmin<\/a>. <img data-recalc-dims=\"1\" decoding=\"async\" alt=\"\ud83d\ude42\" class=\"wp-smiley\" src=\"https:\/\/i0.wp.com\/s.w.org\/images\/core\/emoji\/17.0.2\/72x72\/1f642.png?w=640&#038;ssl=1\" \/><\/p>","protected":false},"excerpt":{"rendered":"<p>WordPress 7.0.2 went out today with two important security updates. One is a type of<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1],"tags":[],"class_list":["post-2862","post","type-post","status-publish","format-standard","hentry","category-world"],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"jetpack-related-posts":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/quicknewsnigeria.com\/index.php?rest_route=\/wp\/v2\/posts\/2862","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/quicknewsnigeria.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/quicknewsnigeria.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/quicknewsnigeria.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/quicknewsnigeria.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2862"}],"version-history":[{"count":0,"href":"https:\/\/quicknewsnigeria.com\/index.php?rest_route=\/wp\/v2\/posts\/2862\/revisions"}],"wp:attachment":[{"href":"https:\/\/quicknewsnigeria.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2862"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/quicknewsnigeria.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2862"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/quicknewsnigeria.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2862"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}