SecOpsAI Daily Intelligence Brief — 2026-11-04

This brief distinguishes source reporting from SecOpsAI's original observations.

CVE-2026-119977: WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

Source-reported by CISA Known Exploited Vulnerabilities.

CISA Known Exploited Vulnerabilities reports: CVE-2026-119977: WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability. CVE-2026-119977 (official CVSS 8.1): WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. CISA lists it as exploited in the wild.

Defensive action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Limitations: Source-reported; SecOpsAI did not reproduce the issue.

Published: not supplied; first observed: 2026-11-03T22:56:36.022450Z.

Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.

| Claim | Check | Source |

| --- | --- | --- |

| CVE-2026-119977 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-119977 |

| CVSS 8.1 | confirmed | https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-119977 |

| exploited in the wild | confirmed | https://www.cisa.gov/known-exploited-vulnerabilities-catalog |

SecOpsAI detection: no SecOpsAI rule covers this yet.

Stanza: RCE via pickle deserialization in the lemmatizer

Source-reported by GitHub Security Advisories.

GitHub Security Advisories reports: Stanza: RCE via pickle deserialization in the lemmatizer. CVE-2026-115878 (official CVSS 7.8): Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. The source also mentions CVE-2026-54499.

Defensive action: Upgrade to a fixed release: stanza 1.15.0.

Limitations: Source-reported; SecOpsAI did not reproduce the issue.

Published: 2026-11-03T20:29:16Z; first observed: 2026-11-03T21:15:35.601280Z.

Verified automatically by SecOpsAI rules (identifiers and scores checked against cve.org and NVD) under the editor's recorded policy.

| Claim | Check | Source |

| --- | --- | --- |

| CVE-2026-115878 exists | confirmed | https://www.cve.org/CVERecord?id=CVE-2026-115878 |

SecOpsAI detection: no SecOpsAI rule covers this yet.

SecOpsAI deployment exposure: PyPI / Python.

Collection scope

Collection is bounded and does not establish comprehensive surveillance. 0 enabled sources lack a fresh successful collection. 5 registry collectors provide metadata coverage without artifact scanning. Unknown eligible-event and evidence-coverage denominators are reported as unknown.

Credits and corrections

Prepared by Onyedika Christopher Agada. Technical verification and final release require recorded human review. Corrections will retain the previous edition and explain material changes.