Cybersecurity Specialist: 2026-09-19
6 minutes in total
Using Cyber Decoys to Strengthen Detection and Response
Cybersecurity and Infrastructure Security Agency (CISA), 2026-09-16. Read, 2 min.
CISA published guidance on 16 September 2026 on using cyber decoys, which it defines as assets that appear to be legitimate systems, accounts, or data but are designed to distract adversaries, detect their presence, or facilitate collection of cyber threat intelligence. The page names honeytokens among the decoy concepts it covers, alongside tripwires and breadcrumbs. The landing page is a short overview and the guidance itself is a downloadable PDF. Listed audiences include executives, federal government, industry, small and medium businesses, and state, local, tribal and territorial government.
Why it matters for this role: Download the PDF, work out which decoy type fits what you actually run, then place one and confirm it produces an alert you can see. Without a dedicated detection team, pick a decoy simple enough that you can maintain it alongside everything else.
WordPress 7.1.1 Maintenance and Security Release
WordPress.org (WordPress core security team), 2026-09-17. Read, 4 min.
WordPress shipped 7.1.1 with 17 core bug fixes, 19 block editor fixes and 11 security fixes, and told site owners to update immediately because it is a security release. The security list includes a stored cross-site scripting issue in wpautop() that allows an unauthenticated visitor to inject script subject to comment approval, reported by Rafie Muhammad, alongside an authenticated path traversal in the WP REST Templates Controller, unauthorized theme installation and preview from WordPress.org via crafted URLs, and several privilege and disclosure fixes. Sites with automatic background updates enabled will take the update on their own; everyone else updates from the dashboard or downloads the release.
Why it matters for this role: For every WordPress site you run or support, verify it is on 7.1.1 and that automatic background updates are enabled, and update from the dashboard where they are not. The stored XSS in wpautop() arrives through comments, so review pending comment moderation on any site that was behind.
The quiz for this edition has closed.