WordPress core RCE chain, SharePoint & SonicWall exploited, Envoy Gateway secret theft

Subscribe your on-call rotation to the new Next.js security channel now — if you're running Next.js in front of client marketing surfaces, you want the pre-notification path rather than reading GitHub advisories the morning of a release. Confirm your Vercel/self-host update process can turn a patch inside 24 hours.

Combined with CVE-2026-53713, this is a bad week for anyone running Envoy Gateway multi-tenant. Verify your xDS port isn't reachable from workload namespaces via NetworkPolicy, not just JWT auth, until you're on the fixed release.

If you're running Envoy Gateway on any cluster that hosts client workloads, upgrade this week and audit who has permission to create EnvoyExtensionPolicy CRDs — that permission is now equivalent to reading every secret the gateway controller can see. Consider RBAC-restricting extension policy creation to platform-team service accounts only.

Every WordPress site you operate needs to be on the patched core release by end of week — this is unauth RCE in core, not a plugin. If auto-updates are disabled on any managed site, reconcile now and check access logs for anomalous requests to admin-ajax and REST endpoints since July 17.

The HTMX filter gap matters if you accept any user-supplied HTML into fields rendered on public pages — 11.2 is EOL, so if you're still there you need an upgrade plan, not a patch. Confirm Layout Builder is disabled or restricted to trusted editors on public sites until 11.4.4 / 11.3.14 is deployed.

If you've stood up any MCP server behind Auth0 or another IdP thinking bearer-token auth was enough, it wasn't — session IDs need to be treated as capabilities until you're on the fixed SDK. Audit any internal AI tooling built on MCP over HTTP for multi-tenant exposure this week.

If any client stack still fronts remote access with SonicWall SMA1000, treat it as compromised until proven otherwise: pull the appliance offline for triage, rotate every credential and session token that transited it, and check for post-exploitation artifacts before restoring service.

Skip if you don't operate anything with a factory floor. If you do: the pattern of IT compromise triggering OT-side production halts keeps repeating — tabletop the scenario where your ERP or identity provider is down and confirm your OT can degrade gracefully instead of stopping.

If you operate infrastructure that touches OT — airport landside, baggage systems, HVAC — inventory ROX II presence and confirm they're segmented from any network your web tier can reach. This is the kind of chain that starts as an OT story and ends as an enterprise breach investigation.

Any on-prem SharePoint reachable from a client extranet or partner VPN needs the July patches applied now. If you don't own the SharePoint but integrate with one (SSO, document APIs), confirm the operator has patched — a compromised SharePoint is a credible pivot into whatever it federates with.

If any of your clients run Oracle EBS Payments and you provide hosting or perimeter — even indirectly — verify the July CPU is applied and that the Payments module isn't reachable from the public internet without an authenticating reverse proxy.

AD FS is the one to prioritize if you still federate on-prem — the KEV entry means someone is actively using it. If you've moved to Entra ID cloud federation, confirm no hybrid AD FS boxes remain reachable for compatibility.