DAILY BRIEFING
WordPress XSS RCE, Linux SCTPhantom Bug, and NC Ports Cyberattack
Today's security updates highlight critical WordPress and Linux vulnerabilities alongside network infrastructure threats and real-world port disruptions.
5 stories2 min read
Critical infrastructure disruptions and foundational software flaws dominate today's security landscape. Operational outages at North Carolina ports underscore the tangible real-world impact of threat activity on physical supply chains.
Finally, underlying architectural assumptions are being challenged by novel network translation attacks, reminding security teams that untrusted workloads must be strictly isolated even behind shared NAT layers.
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
WordPress resolved CVE-2026-64638, a high-severity pre-authentication reflected XSS vulnerability present on its login screen. Researchers demonstrated that chaining the flaw with an administrator interacting with an attacker-controlled page allows remote PHP code execution on default installations.
- Why it matters
- All unpatched WordPress deployments are vulnerable to unauthenticated XSS, exposing servers to complete remote takeover if an admin clicks a malicious link.
- What to do
- Patch WordPress installations immediately to the latest version to mitigate CVE-2026-64638.
North Carolina Ports confirms cyberattack disrupting operations
The North Carolina Ports Authority confirmed a cyberattack that impacted IT systems and slowed operational activity across the Port of Wilmington, Port of Morehead City, and Charlotte Inland Port.
- Why it matters
- Port operational delays can cause immediate regional logistics backlog and supply chain disruptions for shipping networks using these facilities.
18-Year-Old Linux SCTP Flaw Could Let Local Users Gain Root and Escape Containers
A 18-year-old local use-after-free vulnerability in the Linux kernel SCTP networking implementation (CVE-2026-64564 / SCTPhantom) allows local users to gain root privileges and escape container environments.
- Why it matters
- Local attackers or compromised container workloads can escape isolated environments and acquire root privileges on the host system if the SCTP protocol is reachable.
- What to do
- Update Linux kernel to stable release 7.1.6, 6.18.42, 6.12.101, 6.6.148 or later.
New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables
Researchers disclosed NatJack, a new attack class that manipulates NAT connection states to hijack TCP sessions and spoof DNS across implementations including Windows NAT (CVE-2026-56181) and Linux Netfilter conntrack (CVE-2026-63913).
- Why it matters
- Privileged attackers sharing a NAT infrastructure with target systems can intercept TCP traffic, spoof DNS responses, or exhaust NAT tables.
- What to do
- Apply OS patches for Windows and Linux, segment untrusted network workloads, and enforce end-to-end traffic encryption.
Growing Up The Hard Way
An analysis of open-source software security highlights escalating risks driven by automated zero-day discovery tools, industrial scale supply chain attacks, and increasing regulatory compliance demands.
Key takeaways
- WordPress fixed CVE-2026-64638, a high-severity pre-auth XSS on the login page that can lead to PHP code execution when an admin interacts with an attacker…
- Linux patched CVE-2026-64564 (SCTPhantom), an 18-year-old local use-after-free bug in SCTP networking that enables container escapes and root access.
- North Carolina Ports Authority confirmed a cyberattack that disrupted IT systems and slowed operations at three major port facilities.
- NatJack attack techniques manipulate NAT connection state to hijack TCP sessions and spoof DNS, affecting both Windows and Linux implementations.