Security
Security advisories
When a vulnerability affects sites on Quant, we publish what it is, who is exposed, what we have done and what you need to do.
- Action needed high
CVE-2026-119977Published 5 November 2026WordPress core upgrade-window remote code execution (CVE-2026-119977)
WordPress 4.7.0 to 7.1.3 can be exploited without a login while a core upgrade runs. It is actively exploited, and WordPress 7.1.4 fixes it.
- Action needed critical
CVE-2026-109618CVE-2026-109619CVE-2026-111497Published 21 October 2026 · Updated 23 October 2026Critical PHP and Node.js remote code execution vulnerabilities
PHP "php2shell" (CVE-2026-109618, CVE-2026-109619) and the Node.js Brotli decoder flaw (CVE-2026-111497) can lead to remote code execution. Patch the runtime and rebuild.
To report a vulnerability in Quant, see our security.txt. For help with your own site, contact support.