WordPress patched a critical vulnerability (CVE-2026-87902, CVSS 9.2) affecting versions 4.7.0 through 7.1.1 that allows unauthenticated attackers to load external PHP files, potentially enabling code execution on some servers. The fix shipped September 22 across all supported branches, and site owners are urged to update immediately as no workaround exists.
A novel technique exploits SQLite's sqlite_dbpage virtual table to achieve arbitrary file writes and remote code execution by bypassing database header restrictions. By directly manipulating raw database pages via SQL queries and relocating the ELF Program Header Table, attackers can craft and load malicious shared objects, circumventing protections in strict runtimes like Python and Ruby.
Ledge is a Markdown notebook for developers that executes code blocks inline, supporting multiple languages and remote execution over SSH. It features persistent shell state, mobile access via iPad/iPhone, encrypted backups, and integration with Claude through an MCP server.
DigitalOcean has launched Managed Agents, a platform enabling teams to deploy AI agents with access to 16,000+ tools without managing infrastructure. The service integrates code execution, persistent sessions, and tool governance, with per-second CPU billing and response times under two seconds, serving use cases from software development to inventory planning.
A vulnerability in Sentry Seer allows attackers to submit malicious events through public DSNs that propagate through the analysis pipeline and cause a connected coding agent to execute attacker-controlled code within its environment and access source repositories. The exploit chains untrusted event fields into the coding agent's initial prompt, bypassing trust boundaries. No patch is currently available; mitigations include disabling automated remediation or restricting package installation.