Your server is at its most exposed in the minutes it spends updating itself.
r/netsec says an unidentified attacker went after OPSSHIELD, the vendor behind cPGuard, and customers got the news by email. CVE-2026-119977 is a time-of-check time-of-use race condition in WordPress Core: during the upgrade window, unauthenticated attackers could execute code on the server. CISA put it in the Known Exploited Vulnerabilities catalog citing active exploitation, as The Hacker News reported.
One lesson I take: code reaches production through vendors and upgrade paths, not only through user input. If money moves through your app, I review payment and account flows for that exposure. A scoped review takes days, not months. Message me and you get cost and timeline within a day.