Critical WordPress RCE and Ivanti Zero-Days: Immediate Action for K-12 IT

Critical WordPress RCE (CVE-2026-85097) and Ivanti zero-days threaten K-12 networks. Immediate patching, MFA, and incident response steps for IT admins.

• Bricksforge WordPress plugin CVE-2026-85097 (CVSS 10.0) is actively exploited, allowing unauthenticated attackers to upload and execute arbitrary code and take over sites.
• Ivanti Connect Secure zero-day chain (CVE-2026-104935 and two others) grants root access; only two of three flaws have patches.
• Ghostscript CVE-2026-39919 (CVSS 9.8) and the AI-augmented CyberXero campaign show widening risks to document processing and web-facing services.

What to do now

1. Immediately update the Bricksforge plugin to the latest patched version; if no patch exists, deactivate and remove it. Scan all WordPress sites for unauthorized admin accounts, modified files, and suspicious scheduled tasks.
2. Apply Ivanti's available patches for the two fixed Connect Secure flaws immediately. If the third flaw remains unpatched, isolate or restrict access to the VPN appliance at the network edge and monitor for signs of compromise.
3. Patch Ghostscript to version 10.08.0 or later from Artifex or your distribution's security repository. Verify the installed version and restrict network egress from any service that parses untrusted PDFs.
4. Enforce multi-factor authentication and least privilege on all remote access, WordPress admin, and e-commerce accounts. Reset credentials and revoke active sessions if compromise is suspected.
5. Review web server and VPN logs for exploitation attempts targeting these CVEs. Preserve forensic evidence, restore from clean backups if needed, and subscribe to vendor advisories for updates.

Related items

• Geopolitics and the cyber resilience gap belong in your threat model
• CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records
• Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
• CyberXero Used 51 AI Agents to Steal 628,000 Ukrainian Records
• Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
• Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server
• Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
• Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far