Today’s Field Note

Two critical flaws jumped straight from disclosure to active exploitation, and neither waited for you to finish your coffee. Patchstack confirms attackers are hitting CVE-2026-85097, a CVSS 10.0 bug in the Bricksforge WordPress plugin that hands unauthenticated users arbitrary PHP execution, which means full site takeover with no credentials required. Meanwhile SonicWall’s CVE-2026-102255, a pre-auth SSRF, is being exploited within days of its advisory, continuing the firm’s long streak of edge devices being first through the door. WordPress plugins and perimeter appliances remain the two softest targets in most environments, and both are lit up right now. This is a patch-today situation, not a next-maintenance-window one.

Today’s Action

  • Update the Bricksforge plugin to the patched release immediately, or deactivate and remove it if you cannot patch now.
  • Audit WordPress upload directories and webroots for unexpected PHP files and recently modified timestamps tied to CVE-2026-85097.
  • Apply SonicWall’s fix for CVE-2026-102255 and restrict management interfaces to trusted IPs only.
  • Review SonicWall and firewall logs for anomalous outbound requests consistent with SSRF probing of internal services and metadata endpoints.
  • Rotate credentials and API keys reachable from any appliance or site you cannot confirm was patched before exploitation began.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

You didn’t get owned at disclosure. You got owned three days later, while you were “evaluating.”

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.