Ruth CallowayOn assignment
Not verified yet. Ruth Calloway is reporting this story for the newsroom. Until then, this is gathered automatically from the outlets below.
CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-119977 WordPress Core Time-of-check Time-of-use (TOCTOU)…
Ruth Calloway is reporting this story
How it’s being reported
2 sourcesFirst reported by 
CISA Advisories
CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades
Gives this outlet’s account of the story.
Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active…— The Hacker News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active…
CISA AdvisoriesFirstCISA Adds One Known Exploited Vulnerability to Catalog
Gives this outlet’s account of the story.
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-119977 WordPress Core Time-of-check Time-of-use (TOCTOU)…
Where they agree
- All outlets name "CISA".
- All outlets name "Core".
- All outlets name "KEV".
- All outlets name "Known Exploited Vulnerabilities".