CISA confirms active exploitation of WordPress core upgrade RCE
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue on 3 November. Predictable, web-accessible staging paths during full-package upgrades can let an unauthenticated attacker execute code during the upgrade window. WordPress versions 4.7 through 7.1.3 are affected; 7.1.4 fixes the issue.
Why it matters to you
A routine update can briefly create an internet-facing execution path. Upgrade every site to the fixed release for its maintained branch, verify automatic updates completed, restrict access to wp-content/upgrade where possible and inspect web, process and file-change evidence for activity during recent upgrades.
Amazon Redshift JDBC driver could execute attacker-selected classes
AWS disclosed CVE-2026-119084 in Amazon Redshift JDBC Driver versions before 2.3.0. If an attacker can influence a JDBC connection URL or AWS credentials profile, the driver can load and execute arbitrary classes in the application's security context.
Why it matters to you
Database connection strings and profiles often cross deployment pipelines, tenant configuration and support tooling. Upgrade the driver to 2.3.0 or later, patch forks, allowlist connection parameters and rotate credentials if untrusted users could influence a connection configuration.
UK warns AI will scale attacks against long-tolerated weaknesses
The UK National Cyber Security Centre says it is highly likely that nation states will routinely use AI-enabled cyber capabilities by 2028, increasing the scale and speed of sophisticated attacks. It also judges that AI-powered malware is highly likely to be used in a ransomware attack on UK critical infrastructure before then.
Why it matters to you
The near-term risk is faster discovery and exploitation of ordinary weaknesses, not a completely new attack primitive. Reduce exposed legacy services, shorten patch latency, maintain a current asset inventory and automate defensive triage without giving response agents uncontrolled production authority.
EU court adviser draws a line between AI training and generated answers
An adviser to the EU's highest court said Gemini may infringe publishers' rights when it circumvents technical barriers or reproduces the recognisable expression of an article in an answer. The opinion also says EU text-and-data-mining rules can permit training on copyrighted material. The court will rule later and is not bound by the opinion.
Why it matters to you
For SaaS retrieval features, model training rights do not automatically authorize every generated answer. Preserve source provenance, respect access controls, limit verbatim reproduction, link users to originals and give customers enforceable content-use policies.
Portugal prepares renewable-power and water rules for data centres
Portugal is finalising rules that would require data centres to use renewable electricity and either water-free cooling or alternative water sources that do not compete with households and businesses. More than 2.6 GW of capacity is under development, led by the 1.2-GW Start Campus project in Sines.
Why it matters to you
Planned megawatts are not deployable capacity until power, cooling, water and environmental approvals are secured. When selecting European regions or colocation, ask for the exact cooling design, water source, renewable-power contract, review status and an exit plan if commissioning slips.