Author: Natalia Nowak

The flaw WordPress patched in 7.1.2 was under attack the day the fix shipped and is on CISA's KEV list. Code execution needs two host-side conditions.

A judge revived WP Engine's antitrust claims and held that Automattic and Mullenweg cannot bring trademark counterclaims in their own name.

ICANN approved 300 more DropCatch shell registrars this month. One company now holds 1,501 of 3,321 accreditations, and the registrar count means less.

Managed.com launched on September 17 above HostPapa, ColoCrossing, Hostopia, CloudBlue and LogoMaker, a group built on more than twenty acquisitions.

An authenticated cPanel account holder could run code as root through CalDAV and CardDAV. Three builds carry the fix, dated September 22.

ICANN confirms 1,616 of 1,663 gTLD applications proceed after payment, with Reveal Day due by October 14 and the exact date still a week away.

nginx 1.31.5 adds a REST interface that reads the running config and grades every reload. Whether a server has it is settled at build time.

GitHub, Salesforce and SharePoint each lost core functions in four days, and each company's own account blames an internal change, not an attack.

WordPress 7.1.1 was planned as bug-fix only and shipped with 11 security fixes, one an anonymous comment XSS the sanitizer does not catch.

A CVSS 9.8 flaw sits under WordPress photo uploads, in a system library the host has to patch. Twenty days after the fix, it has no CVE number.