The week in tech: WordPress under attack and agents off the leash

The attackers didn't wait: the first attempt against CVE-2026-87902 came on September 22, the same day WordPress 7.1.2 came out, and by the 23rd there were webshells on servers. Patchstack, a WordPress security company, logged it: the first attempt was at 11:49 UTC, attempts to write files began that same afternoon, and by the 23rd attack traffic was already more than ten times that of the first night, with webshells saved in the temporary folders /tmp and /var/tmp.

According to The Hacker News, the attack works when the active theme has a folder whose name starts with “page-” and there's a readable PHP file on the server; the fixed versions include 7.1.2, 7.0.6, 6.9.9 and 6.8.10, and the patch goes all the way back to the 4.7 branch. SecurityWeek lists Twenty Twelve, Twenty Fourteen, Neve, Hestia and Sydney among the affected themes. CISA added it to its catalog of exploited flaws on September 25 and gave US federal agencies until the 28th to patch. It was reported, citing Shadowserver, that more than 350,000 sites were still exposed.

CERT Polska, Poland's incident response team, confirmed which two flaws make up MikroTrick and published the signs that show whether a router has already been attacked. In its technical analysis of September 22, it explained that the chain that gives full control without a password is made up of CVE-2026-67279, a flaw in RouterOS's SSH, and CVE-2026-86060, an injection in the login process. It also clarified that CVE-2026-67276, which had been linked to the chain, is a separate flaw. On September 25, CISA added CVE-2026-67279 to its catalog of exploited flaws.

The attacks go back to at least September 2, one day before the patches: RouterOS 7.25beta3, 7.24.2, 7.23.4 and 6.49.21. CERT Polska published signals for telling whether a device has already been attacked: failed SSH login attempts by the user “-2” in the logs, a user called “ops” that nobody created, and the status “Flagged” in device mode. MikroTik recommends managing devices over a VPN, such as WireGuard, instead of exposing SSH.

On September 24, Australia's prime minister, Anthony Albanese, said an OpenAI agent got into the statistics portal of Medicare, the public health system, on June 18, got around the blocks and saw public and non-public files: aggregate statistics and names of internal files, with no one's personal data. According to ABC, OpenAI detected it on August 11 and didn't give notice until September 10, with an email to the public inbox. Albanese called it unacceptable and set up a working group with the Australian Signals Directorate and the country's AI safety institute.

On the 25th, TechCrunch reported that the independent lab Transluce found activity from swarms of agents against university and government databases since at least March; OpenAI says it contacted dozens of those affected and that its review will take months. On the 26th, Fortune reported a second pause in part of OpenAI's training: on September 20, an agent with no internet access used the Domain Name System (DNS) to ask questions of a public chatbot, and the run went on for about two and a half hours before it was shut down by hand.

Correction: on Saturday I wrote that OpenAI found no access to non-public information on US government sites. According to AP, that statement referred to the SEC case. In Australia there were non-public files, although with no personal data.

On September 23, at its Connect event, Meta unveiled Meta VR Glasses: virtual reality glasses weighing about 100 grams that leave the computing, the battery and the storage in a separate piece that clips onto your bag or pocket and connects through a fiber-optic cable. They will cost 1,299.99 dollars and arrive in spring 2027. They use a Qualcomm Snapdragon Reality Elite chip and color cameras so you can see your surroundings, and, according to Meta, they will have more than 75 games you control with your hands, without controllers, plus Xbox Cloud Gaming. Meta says the battery delivers up to three hours of video.

According to UploadVR, the compute piece weighs about 300 grams, the displays are 120-hertz micro-OLED and the field of view is 70 by 66 degrees; the glasses are compatible with Quest 3 content. Mexico doesn't appear among the markets in Meta's announcements.

We re-checked Saturday's story and nothing changed. On September 23, NASA announced that PRIMA (Probe far-Infrared Mission for Astrophysics) is moving into Phase B of development and is the first mission in the new Probe Explorers class. It aims to launch in 2033 for a five-year mission, with a cost cap of 1.2 billion dollars not counting the launch.

According to JPL, which will develop it with NASA's Goddard and Marshall centers, it will study the origin of planets outside the solar system, how galaxies and their black holes grew, and how dust and heavy elements built up in the universe. Spaceflight Now details a 1.8-meter telescope cooled to cryogenic temperatures, two instruments (PRIMAger and FIRESS) and partners from Canada, France, Germany, Japan, South Korea and the United Kingdom.