News Roundup: August 19–26, 2026

This week’s roundup leans heavily on WordPress plugin security — three separate critical bugs landed in the space of a few days — plus the usual crop of vendor releases for the stack this blog runs.

• Elementor Pro 4.2.2 fixes an unauthenticated RCE (CVE-2026-32475, CVSS 9.0) in the File Upload form module — any site with a published Elementor form containing a file upload field could have a PHP file dropped and executed with no login and no nonce. The researcher reported it in mid-July and Elementor had a fix ready within a day, but sat on the release for over a month. If you run Elementor Pro forms, don’t assume “recently patched” means “recently disclosed.”
• Everest Forms patched an unauthenticated file-upload RCE (CVE-2026-19598) affecting over 100,000 sites — a second forms plugin with essentially the same class of bug as Elementor’s this week. If you’re running any form plugin with file-upload fields, this is a good week to audit which ones are actually still needed on your site.
• TranslatePress 3.3.2 closes a critical, unauthenticated privilege-escalation bug (CVE-2026-19632, CVSS 9.8) that let attackers hijack administrator accounts outright. Combined with the two form-plugin bugs above, it’s been a rough week for WordPress plugin security specifically — worth a pass through your installed plugins if you haven’t updated in a while.
• WordPress core 7.0.4 is a security-only release fixing an authenticated Author+ remote code execution bug (CVE-2026-65640) on sites running Imagick with Ghostscript. Narrower than the plugin bugs above, but nastier if you accept uploads from non-admin users — don’t wait on auto-updates for this one.
• nginx 1.31.4 (mainline) / 1.30.4 (stable) patch a heap buffer overflow in the map directive’s regex handling (CVE-2026-42533) and a memory-disclosure bug in ngx_http_slice_module (CVE-2026-60005). Routine but not optional if nginx is sitting in front of anything.
• Proxmox VE 8 reaches end of life on August 31 — no more security patches after that date, so this is the week to schedule the upgrade to VE 9 if you haven’t already. Separately, Proxmox VE 9.2 shipped official Arm64 support with full KVM/LXC/ZFS/Ceph parity, worth a look if you’re running or considering Arm homelab hardware.
• Linux 7.2 is out, one of the busier kernel cycles on record at nearly 600,000 lines changed. Also worth noting: Fedora is taking the first concrete step toward restricting AF_ALG, the kernel’s userspace crypto API that’s been the source of several serious bugs this year — check whether anything on your boxes touches it directly before it starts getting locked down upstream.
• MikroTik shipped RouterOS 7.24.1 stable, a maintenance release with bridge MLAG fixes on CRS8xx switches, VRRP-on-bridge stability improvements, and container host isolation hardening. If your MikroTik box is doing edge routing, it’s an easy hour of maintenance with real payoff.
• InfluxDB 3.8 (Core and Enterprise) is about operational maturity rather than new query features — proper systemd units on the deb/rpm packages and an official Helm chart for running Enterprise on Kubernetes. Relevant if you’re on the TICK stack for homelab metrics and haven’t looked at the 3.x line yet.