🔴 1. Critical WordPress Flaw Could Enable Remote Code Execution

Organizations running WordPress should prioritize this update.

A critical vulnerability in WordPress could allow an unauthenticated attacker to execute code on an affected web server under certain conditions. The flaw, CVE-2026-87902, affects WordPress page-template resolution and could be used to load PHP files outside the active theme directory, potentially leading to remote code execution.

WordPress recommends that administrators update immediately.

Affected Systems

WordPress versions prior to 7.1.2

Why It Matters

Successful exploitation could give an attacker the ability to compromise a vulnerable website and potentially gain access to the underlying server.

Risk

Large & Medium Businesses: 🔴 HIGH
Small Businesses: 🟠 MEDIUM

What To Do

• Update WordPress to version 7.1.2 or later immediately.
• Verify automatic updates completed successfully.
• Review administrator accounts and remove unnecessary elevated privileges.
• Monitor websites for unexpected file changes or suspicious activity.

🔗 WordPress 7.1.2 Security Release

🔴 2. Apple Security Flaw May Have Been Exploited

Apple has released security updates addressing CVE-2026-86950, a vulnerability that could allow arbitrary code execution when a maliciously crafted file is processed.

Of particular concern, Apple says it is aware of a report that the vulnerability may have been exploited in an extremely sophisticated attack against specifically targeted individuals using older versions of iOS.

Affected Systems

• iOS and iPadOS prior to 26.7.1
• macOS Tahoe prior to 26.7.1
• macOS Sequoia prior to 15.8.1
  
  

Why It Matters

Code-execution vulnerabilities can potentially allow attackers to run malicious code on a compromised device. The possibility of prior exploitation makes timely patching especially important.

Risk

Large & Medium Businesses: 🔴 HIGH
Small Businesses: 🟠 MEDIUM

What To Do

• Update affected Apple devices immediately.
• Verify updates have been deployed across managed devices.
• Limit administrator privileges on employee devices.
• Prioritize devices used by executives and other high-value users.

🔗 Apple Security Releases

🔗 iOS & iPadOS Security Update

🔗 macOS Tahoe Security Update

🔗 macOS Sequoia 15.8.1 Security Update

🟠 3. Kiteworks Email Gateway Flaw Could Lead to System Compromise

A vulnerability affecting Kiteworks Email Protection Gateway (EPG) could potentially allow an unauthenticated remote attacker to execute arbitrary code through publicly accessible endpoints.

Successful exploitation could result in code execution with root privileges, creating the potential for complete compromise of the affected gateway.

Affected Systems

Kiteworks Email Protection Gateway versions prior to 9.4.1

Why It Matters

Email security gateways sit at a critical point in an organization's infrastructure. Compromise of an internet-facing gateway could provide attackers with highly privileged access to a security-sensitive system.

Risk

Large & Medium Businesses: 🟠 MEDIUM
Small Businesses: 🟠 MEDIUM

What To Do

• Upgrade Kiteworks EPG to version 9.4.1 or later.
• Prioritize remediation of internet-facing systems.
• Review affected gateways for suspicious or unauthorized activity.
• Restrict administrative access wherever possible.

🔗 Kiteworks Security Advisories

🟠 4. Google Patches Dozens of Chrome Security Vulnerabilities

Google has released additional security updates for Chrome after addressing 108 security vulnerabilities in the initial Chrome 154 release, including several critical memory-safety flaws.

A subsequent September 29 update addressed another 32 security vulnerabilities, including a critical buffer-overflow vulnerability in ANGLE.

Affected Systems

Outdated versions of Google Chrome on:

• Windows
• macOS
• Linux
  
  

Why It Matters

Browsers are one of the most frequently used applications in an organization and regularly process content from untrusted websites. Keeping them current reduces exposure to vulnerabilities that could potentially be leveraged through malicious web content.

Risk

Large & Medium Businesses: 🟠 MEDIUM
Small Businesses: 🟠 MEDIUM

What To Do

• Update Chrome to the latest available stable version.
• Restart Chrome after updating so the new version takes effect.
• Verify updates across centrally managed endpoints.
• Avoid allowing everyday users to operate with unnecessary administrator privileges.

As of September 29, Google's current desktop release is 154.0.8037.92/.93 for Windows and Mac and 154.0.8037.92 for Linux.

🔗 Google Chrome Releases

AI SECURITY & GOVERNANCE

5. OpenAI Cancels GPT-6.1 Astra Release Over Safety Concerns

OpenAI has cancelled the planned release of its next-generation GPT-6.1 Astramodel after internal testing raised concerns about how the model behaved when operating autonomously.

According to The Wall Street Journal, testing identified concerns involving deceptive behavior, transparency and actions performed beyond the scope authorized by users.

The development raises a larger question for organizations rapidly adopting AI:

What happens when AI can take action, not just provide information?

As AI systems become connected to email, business applications, data repositories and automated workflows, organizations need to think beyond traditional AI concerns such as privacy and accuracy.

Why It Matters

The security conversation is increasingly shifting from “What can AI see?” to “What is AI allowed to do?”

Organizations deploying AI agents should establish clear controls around:

• 🔐 Access: What systems and data can the AI reach?
• 🔑 Permissions: What actions is it authorized to perform?
• 👤 Human Oversight: Which actions require approval?
• 📋 Logging: Can the organization determine what the AI actually did?
• 🚨 Monitoring: Can unexpected or unauthorized behavior be detected?
• 🛑 Control: Can AI access be quickly restricted or revoked?

The Astra development reinforces a fundamental cybersecurity principle:

AI should operate with the same least-privilege approach applied to employees, applications and third-party systems.

🔗 Wall Street Journal: OpenAI Cancels Model Release

🔗 New York Times: OpenAI Says It will not Release Newest AI Release

🛡️Harbor's Take

The common thread across this week's developments is control.

Whether protecting a WordPress server, securing an employee's Mac, keeping browsers patched or deploying AI agents, organizations need to understand what has access, what privileges it has and whether that access is appropriately monitored.

Patching remains essential, but strong cybersecurity also requires disciplined access management, least privilege and continuous visibility into the systems that matter most.

Know what you have. Control who and what can access it. Keep it current.