Apple and WordPress Vulnerabilities Added to CISA Catalog

Federal cybersecurity officials added actively exploited Apple and WordPress security flaws to the Known Exploited Vulnerabilities catalog. The directives require immediate remediation to prevent info-stealing malware and remote code execution attacks across enterprise systems.

The U.S. Cybersecurity and Infrastructure Security Agency added a medium-severity authentication flaw impacting multiple Apple operating systems to its catalog following reports of active exploitation, The Hacker News reported. Tracked as CVE-2024-27834 with a CVSS score of 5.5, the vulnerability allows an attacker with arbitrary read and write capability to bypass Pointer Authentication. Apple originally addressed this security issue in May 2024 with improved checks across iOS, iPadOS, macOS, tvOS, watchOS, and Safari. The addition follows reports from Sekoia indicating that threat actors potentially linked to Russia exploited previously patched vulnerabilities in Safari and Google Chrome to deliver browser and device data harvesting malware.

Attribution for the activity points with moderate to high confidence to APT29, a state-sponsored hacking group also known as Cozy Bear and Midnight Blizzard, according to The Hacker News. The threat actors utilized three initial access pathways involving compromised legitimate websites, fake sites mimicking popular pages, and a supply chain attack targeting Plerdy SEO Tracker. These pathways served malicious JavaScript that triggered the vulnerability and deployed information-stealing payloads after profiling visitor devices. Federal Civilian Executive Branch agencies were instructed by CISA to apply the necessary patches by November 18, 2026.

In a separate advisory covered by BleepingComputer, CISA warned federal agencies that attackers have also started exploiting a recently patched high-severity WordPress vulnerability in the wild. Tracked as CVE-2026-119977, this WordPress Core flaw stems from a Time-of-check Time-of-use race condition reported by Umut Bayram. Successful exploitation permits remote threat actors without privileges to execute code on the server during full-package core upgrades. The WordPress security team released version 7.1.4 with patches to address this security weakness on October 28. CISA ordered federal agencies to secure their systems against this WordPress flaw by Friday under Binding Operational Directive 26-04.

Background

The Apple vulnerability was initially demonstrated as a zero-day at the Pwn2Own Vancouver hacking contest held in March 2024. The exploit chain combined a remote code execution flaw in WebKit and the pointer authentication codes bypass to execute a JavaScript payload designed for browser cookie theft. Meanwhile, the WordPress core flaw involves a weakness in the upgrade process that creates predictable and web-accessible staging paths during upgrades.

WordPress security firm Wordfence reported blocking thousands of attacks targeting the WordPress core vulnerability within a 24-hour window. In July, the WordPress security team also patched a critical vulnerability chain named wp2shell, which was subsequently weaponized by a Chinese-speaking threat actor in September to steal sensitive data from more than 18,500 backend database records belonging to small businesses and government organizations.

Why It Matters

Active exploitation of both Apple and WordPress vulnerabilities highlights the continuous risks organizations face from automated attacks targeting legacy software components. Network defenders in both public and private sectors may need to prioritize rapid patch management to mitigate data theft and unauthorized server access.

Illustration: AI-generated image, not a photograph of the event.