GoKawiil
Tech News
Researcher Jack Taylor found a second-order SQL injection flaw, CVE-2026-19949, in the All-in-One WP Migration and Backup WordPress plugin, used on over five million sites. Attackers can plant malicious data via trackbacks that activates when an admin exports or imports a site, exposing a secret key that lets them upload a malicious archive containing executable code and seize control of the website.
An engineer upgrading a MySQL database via a replica discovered that a table's auto-incrementing primary key was assigned in a different row order on the replica than on the source. Because six related tables had been migrated to reference these new IDs, one of them ended up pointing to completely wrong rows after the switchover, while the other five happened to remain correct.
A developer created a workaround that adds rollback functionality to Flyway's free Community Edition, which normally reserves database migration undo capability for paying Teams subscribers. The trick treats every rollback as a forward migration: instead of reversing an applied migration, the tool writes a new, higher-numbered migration containing the reverse SQL, then cleans up Flyway's schema history table so the recorded state matches the database and files on disk. The implementation relies entirely on standard Flyway commands rather than direct SQL execution against the database.
An executive coach recounts working with a manager who drove a fast platform migration and hit every deadline, assuming a lack of pushback meant the team was fine. The coach argues this speed often masks disengagement, burnout, and silent resistance that surface later as attrition or stalled execution.