📝 Show notes
CyberAware Daily — 2026-11-07
- Weekend Short: a WordPress plugin flaw is being actively exploited, and the fix is out
- The catch: the update itself can briefly expose some sites, so timing and backups matter
- Who's affected: anyone who runs or looks after their own WordPress site; if a host manages it, they should act
- Practical steps: back up, update the plugin, check the site afterwards, and confirm with whoever manages it
- DarkWatch: 3,354 alerts and 11 active targets being monitored — nothing new for households beyond unique passwords and two-step verification
- Not covered today: OpenSSH SSHole — we've covered the recent OpenSSH fixes already
More at https://cyberawareuk.co.uk
📄 Full transcript
It's Saturday, the 7th of November, and this is CyberAware UK.
I am Bully, and joining me is Alex.
Today it's our weekend short, one thing to know, one thing to do.
Nice and simple.
So what's the thing to know this weekend, Bully?
WordPress.
There's a flaw in a widely used WordPress plugin that attackers have been actively exploiting,
and the fix is out.
But here's the twist.
Installing that fix can briefly expose some sites one last time while the update runs.
That sounds a bit backwards.
Can you unpack that for people who just run a small blog or a local business site?
Course, the plugin needs updating.
During the update, there's a short window where the protection is being swapped over,
and a poorly timed automated scan can catch the site in that gap.
So who actually needs to act here?
Is this everyone with a WordPress site or just a certain group?
If you run your own WordPress site, or you look after one for a club, a church, a small shop,
yes, act, if someone else hosts and manages it for you, they should be doing this.
The household listener probably just needs to check they know who that person is.
And what's the practical thing?
Do they need to sit up all night watching it?
No, take a backup first, then update the plugin promptly,
and update it out of hours if your host lets you schedule it.
After the update, load the site once and check it looks right.
That's it.
What about people who don't know what plugin they've got?
Log into the dashboard, go to plugins, and look for anything showing an update available.
If you don't recognize a plugin and you're not using it,
that's a conversation with whoever set the site up, not something to delete blind.
Fair.
Is there anything else from the weekend's threat picture worth a mention?
Our dark web monitoring is still ticking along.
Just over 3,000 alerts across the past stretch and 11 active targets being watched.
Nothing new for a household to do about that beyond the usual.
Unique passwords and turn on two-step verification.
And there was a story about OpenSSH being targeted within hours of a disclosure,
but we covered the OpenSSH fixes recently, so we'll leave that one.
Right, the reason we're on WordPress today is it's the one that touches normal people.
The bakery site, the village hall page, the blog your aunt runs.
Let's do the takeaway then, because that's the bit people remember.
Here it is.
This weekend, if you own or look after a WordPress site,
take a backup and then install the pending plugin update.
And if you don't know who manages your site,
find out and ask them to confirm it's done.
Short, specific, and doable before Monday.
That's the weekend short.
Keep your passwords unique, keep your updates moving,
and we'll be back on Monday.
Take care.