Today’s Field Note

Three things are actually burning today, so ignore the AI conference noise. CVE-2026-5430, a CVSS 9.8 JWT signature bypass in WSO2 API Manager, is being exploited in the wild with forged admin tokens, per watchTowr, which means full account takeover on anything internet-facing. Wordfence is separately watching unauthenticated attackers upload PHP backdoors through WooCommerce Wholesale Lead Capture (6,000+ installs), a straight path to RCE on your storefront. And Google’s September Pixel patch closes 110 bugs including a modem zero-day already used in limited, targeted attacks, which is the kind of thing that lands on executives and journalists first, not everyone. Patch the perimeter stuff before you touch anything else.

Today’s Action

  • Patch WSO2 API Manager now, then hunt for forged JWTs and anomalous admin sessions in logs going back weeks, since exploitation predates disclosure.
  • Update or remove WooCommerce Wholesale Lead Capture, and scan web roots for freshly dropped PHP files and unexpected uploads.
  • Push the September 2026 update to all Pixel fleet devices, prioritizing high-risk users (execs, legal, press contacts).
  • Audit any internet-exposed WSO2 instances for admin accounts created or modified recently, and rotate keys.
  • Confirm your WAF (Wordfence or otherwise) is blocking the WooCommerce upload path as a stopgap until patching completes.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Patch the doors people are already walking through. The rest can wait.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.