The thing that updates your server is now also a way into it.
In a post on r/netsec, a former cPGuard subscriber shared an email the vendor sent its customers and partners: an unidentified attacker targeted OPSSHIELD and gained access. CISA listed CVE-2026-119977, a time-of-check time-of-use race condition in WordPress Core that could let unauthenticated attackers execute code on the server during the upgrade window. The Hacker News reports CISA added that WordPress Core flaw to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
Both cases point at the same uncomfortable thing: the upgrade path runs in production, with production privileges, while teams tend to file it under maintenance. Automatic updates from a vendor, and the window while a core update is being applied, are both places where code runs with your privileges and nobody is watching. Most teams have no inventory of which services on their fleet can update themselves, from where, and under whose signature.
That inventory is the work we take on. We map every update channel across your servers, pin versions, verify signatures, and review what those machines are allowed to reach on the way out. For a small fleet that takes days rather than months, and you get cost and timeline from us within a day.
If you run software someone else updates for you, you probably cannot say today which of those channels you would notice going bad.