Category: Security

Vercel paid $50,000 for a guest-to-host-root KVM escape found in its Firecracker sandbox. No CVE, kernel range or patch is public, and every VPS fleet runs KVM.

Attackers are targeting Ninja Forms and WPC Product Bundles with a payload built to hide its own WordPress admin and outlast plugin removal.

HostGator and Monarx recorded more than 51 million proactive security actions in Brazil between March and August 2026.

The flaw WordPress patched in 7.1.2 was under attack the day the fix shipped and is on CISA's KEV list. Code execution needs two host-side conditions.

An authenticated cPanel account holder could run code as root through CalDAV and CardDAV. Three builds carry the fix, dated September 22.

WordPress 7.1.1 was planned as bug-fix only and shipped with 11 security fixes, one an anonymous comment XSS the sanitizer does not catch.

A CVSS 9.8 flaw sits under WordPress photo uploads, in a system library the host has to patch. Twenty days after the fix, it has no CVE number.

LiteSpeed Enterprise 6.3.7 shipped three security builds in six days, after a cPanel advisory on a root path from a hosting account. Build 2 is the one to run.

Acronis patched a privilege-escalation flaw in its cPanel backup plugin and reports limited attacks. CISA listed it with a September 19 deadline.

Six months after disclosure, a WooCommerce extension is still drawing blocked exploit attempts. The largest spike came on August 30.