WordPress core RCE now exploited — patch to 7.1.2 today
Exploitation began under five hours after the fix and surged tenfold; the official PHP Docker image is exposed. Plus Qwen-Audio's 95% cut, free Vercel Blob.
Copy markdown
One unauthenticated request can run PHP outside your theme
CVE-2026-87902 (CVSS 9.2) is an unauthenticated path traversal in WordPress core's template loader: it fails to strip ../ from a URL, so an attacker can load arbitrary local .php files. It reaches conditional RCE when the active theme has a top-level folder starting with page- and PHP's register_argc_argv is on — the default state of the official PHP Docker image and cPanel setups on PHP before 8.5. The fix shipped in 7.1.2 on Sep 22 and was backported to every branch since 4.7; 4.6 and older get nothing.
It was weaponized in under five hours — patch now, don't wait for your host
Recon hits started at 17:44 UTC on Sep 22, less than five hours after the patch dropped, and by Sep 23 attacks had jumped tenfold. Payloads drop into /tmp as files like wp-pear-rce-flag.php and poc87902.php that run shell commands when hit. Update to 7.1.2 (or 7.0.6 / 6.9.9 / your branch's fix) today, and block the known source IPs 169.58.48.193, 169.58.48.195, and 2001:df1:e8c0::106b.
Qwen-Audio 3.1 cuts voice APIs up to 95%
Alibaba shipped a full five-model audio stack on Sep 23 — ASR, ASR-Next, TTS, TTS-Next, and a realtime model — and slashed prices: ASR down up to 95%, realtime ~85%, TTS ~70%. TTS-Next generates speech, sound effects, and background audio in one pass, and the realtime model speaks and listens simultaneously with instant interruption. Always-on voice agents just got cheap enough to actually leave running.
Vercel Blob drops the plan-tier store cap
As of Sep 23, store creation is no longer gated by plan tier — you can spin up unlimited Blob stores on any plan. Each creation bills as one Advanced Operation and deleting a store is free, which makes per-tenant or per-branch storage isolation practical without an upgrade.