Author: Natalia Nowak

An authenticated cPanel account holder could run code as root through CalDAV and CardDAV. Three builds carry the fix, dated September 22.

ICANN confirms 1,616 of 1,663 gTLD applications proceed after payment, with Reveal Day due by October 14 and the exact date still a week away.

nginx 1.31.5 adds a REST interface that reads the running config and grades every reload. Whether a server has it is settled at build time.

GitHub, Salesforce and SharePoint each lost core functions in four days, and each company's own account blames an internal change, not an attack.

WordPress 7.1.1 was planned as bug-fix only and shipped with 11 security fixes, one an anonymous comment XSS the sanitizer does not catch.

A CVSS 9.8 flaw sits under WordPress photo uploads, in a system library the host has to patch. Twenty days after the fix, it has no CVE number.

LiteSpeed Enterprise 6.3.7 shipped three security builds in six days, after a cPanel advisory on a root path from a hosting account. Build 2 is the one to run.

AWS cannot restore access to data hosted exclusively in its Bahrain region, or in one of three UAE zones. Most customers had already moved out.

Acronis patched a privilege-escalation flaw in its cPanel backup plugin and reports limited attacks. CISA listed it with a September 19 deadline.

Many owners asking what their hosting business is worth have not decided to sell. The busier part of the market comes before any deal is announced.