Category: Security

Only 35 percent of All-in-One WP Migration installs run the 7.110 fix. About 3.2 million sites are on a vulnerable version as the exploit chain goes public.

Exploit attempts against the Elementor Pro file upload flaw began the day it was disclosed, and one firewall alone blocked over 190,000 of them.

High-severity fixes for All-in-One WP Migration and Gravity Forms shipped August 20. One changelog called it a text fix, the other used a stock phrase.

An attacker hijacked routes to Softaculous servers for two nights, got a valid TLS certificate, and delivered a malicious update to some Virtualizor installs.

A cPanel customer able to add parked domains could gain root on the whole server. CVE-2026-65643 affects all supported versions; patches are out.

InMotion is deploying Monarx ThreatShield across its server fleet, moving attack blocking into the PHP engine itself.

Plesk has patched three flaws reachable from an ordinary customer account. The worst can end at root, and its fix ships outside the core update.

ix major CDNs amplify attacker traffic toward the sites they front. Two have deployed mitigations, four are still discussing it.

Forminator's 9.8 file upload flaw was patched seventeen days before it went public, and the changelog shows eleven more fixes around it.

A critical VMware flaw may let a guest VM run code on the ESX host, and Broadcom ships no workaround for it.