Week's patches: critical RCE in Bricksforge, Apache, OpenSSH and curl on Ubuntu

WordPress site managers and Ubuntu server administrators had a busy week from 13 to 19 October 2026. The most serious vulnerability concerns a plugin for Bricks, WordPress's visual builder; on the operating system front, Canonical published four security notices (USN) for packages running on practically every hosting server: curl, Apache, Bind, and OpenSSH.

WordPress: Bricksforge under active attack

The week's most critical vulnerability is CVE-2026-85097, CVSS 10.0, in the Bricksforge plugin. The flaw allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress sites, resulting in remote code execution; it affects versions up to and including 3.1.8.9, patched in 3.1.8.10.

According to Patchstack, exploits of the flaw were detected from 7 October 2026, at 21:47 UTC, before the patch was even published. Wordfence described the technical vector: the flaw stems from insufficient validation of a URL field in the 'temporaryFileUploads' parameter during form submission, and an attacker can obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint to then upload a GIF/PHP polyglot file. For site managers using WP-CLI: wp plugin update bricksforge --version=3.1.8.10.

Other WordPress vulnerabilities reported during the week, all via Wordfence/Patchstack:

CVE	Plugin	Vulnerable version	Published
CVE-2026-93767	Tainacan	up to 1.3.0	16 October
CVE-2026-104003	ProfilePress	up to 4.17.5	16 October
CVE-2026-92978	User Registration & Membership	up to 5.2.8	16-17 October
CVE-2026-100316	European VAT Compliance Assistant for WooCommerce	up to 1.36.10	17 October
CVE-2026-110253	weForms	up to 1.6.28, fix 1.6.29	17 October

For Tainacan, it's an authenticated path traversal (Subscriber+ role) allowing arbitrary file reads via the 'guid' parameter. For weForms, unauthenticated attackers can delete arbitrary media files, with a fix available in version 1.6.29 according to the plugin's official repository.

Ubuntu: four USNs on 14 October

Canonical published four Ubuntu Security Notices on 14 October covering software present on most production servers:

• USN-8932-1 (curl): published 14 October, covers Ubuntu 24.04 LTS, 22.04 LTS, 20.04 LTS, 18.04 LTS, 16.04 LTS and 14.04 LTS, with CVE-2026-92388, CVE-2026-92389, CVE-2026-87864 and six others.
• USN-8931-1 (Apache HTTP Server): published 14 October, CVE-2026-73637, CVE-2026-63292, CVE-2026-93546 and six others.
• USN-8929-1 (Bind): published 14 October, covers Ubuntu 26.04, 24.04, 22.04, 20.04, 18.04, 16.04 and 14.04 LTS, with 24 CVEs in total.
• USN-8928-1 (OpenSSH): published 14 October, covers Ubuntu 26.04 LTS, 24.04 LTS and 22.04 LTS, with CVE-2026-106552, CVE-2026-106553, CVE-2026-106585 and six others.

On 15 October, USN-8933-1 (RabbitMQ Server), USN-8922-2 (Linux kernel Azure) and USN-8883-2 (Go) followed; the latter affects Ubuntu 22.04 LTS with CVE-2026-39821, which could allow unintended network service access.

For all these packages the command remains the same on every supported Ubuntu version:

sudo apt update && sudo apt upgrade

The exact corrected package versions, specific to each Ubuntu release, are listed in the "Update instructions" section of each notice at ubuntu.com/security/notices. For kernel packages (as in the Azure case) a system reboot is required after the update.

What to check by today

Anyone with Bricksforge installed should update immediately to 3.1.8.10: the flaw is actively exploited. On Ubuntu, prioritise OpenSSH and Apache if exposed on public interfaces: they are the services most directly reachable by a remote attacker.