{"uuid": "570c3f34-1b40-4933-9977-bc0f76f182e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-87902", "type": "seen", "source": "https://bsky.app/profile/wpsecurityninja.bsky.social/post/3mwbhgv4okc23", "content": "Yesterday: patch and probes.\nToday: attackers writing PHP via pearcmd on unpatched WordPress (CVE-2026-87902).\n\nUpdate past 7.1.1 to 7.1.2 (or your branch backport), then check logs and /tmp|/var/tmp for names like wp-pear-rce-flag.php, poc87902.php, luci_.php, zeta_.php.", "creation_timestamp": "2026-09-24T14:23:58.875900Z"}