⚠️ALERT: Hackers are now targeting WordPress, the software behind 39.5% of all websites online. A critical flaw lets attackers take over a WordPress site in the seconds it spends updating, without needing to log in. During a full update, WordPress briefly stages its installer in a public folder, and anyone who reaches it in that window can run their own code on the server. It affects every version from 4.7 to 7.1.3, nearly 10 years of releases going back to December 2016. What has happened so far: Security firm Wordfence flagged the flaw, now tracked as CVE-2026-119977 Its first firewall block came just 9 minutes after the protection went live It saw more than 18,500 attack attempts in the first 21 hours after the flaw went public Some attackers spent about 14.5 hours repeatedly checking small groups of sites, waiting to catch one mid-update Wordfence blocked 12,632 attempts in a single 24-hour period On Nov 3, US cyber agency CISA confirmed active attacks and ordered federal agencies to patch by Nov 6 What’s being done: WordPress has released fixed versions for every affected branch, including 7.1.4. Wordfence is blocking the attacks with a firewall rule. Wordfence urges site owners to update as soon as possible, and says they can block access to PHP files in /wp-content/upgrade/ before updating for extra protection. If you run a WordPress site, update now, and take that precaution first if you can.