Category: Security
82 articles
Security
EU Software Makers Now Have 24 Hours to Report an Exploited Flaw.
The EU now requires software makers to report actively exploited flaws within 24 hours, and a GPL plugin with a paid tier counts as a product.
Partners
Monarx Launches Dark Web Monitoring. One Domain Covers Every Address on It.
Monarx has launched a white-label dark web monitoring service for hosts. It starts from a domain and shows the categories of breached data, not the values.
Security
A cPanel Account With Mail Privileges Could Reach Root. Every Supported Version Was Affected.
cPanel has patched CVE-2026-67401, a flaw rated 9.9 out of 10 that let an authenticated account with mail privileges run code as root.
Security
A Magento Zero-Day Is Being Exploited Now. The First Known Victim Was Fully Patched.
An unpatched Magento flaw has been exploited since September 4. The first known victim had a clean patch status, and the backdoor installs outside the web root.
Security
WHMCS Has an Unauthenticated RCE. The Fix Exists Only for 9.0.8 and 8.13.7.
WHMCS fixed an unauthenticated RCE and a 2CheckOut data disclosure flaw in 9.0.8 and 8.13.7. Installations on 8.0 through 8.12 have no patch and must upgrade.
Security
Nearly Two-Thirds of All-in-One WP Migration Installs Remain Unpatched Two Weeks Later
Only 35 percent of All-in-One WP Migration installs run the 7.110 fix. About 3.2 million sites are on a vulnerable version as the exploit chain goes public.
Security
Attacks on the Elementor Pro Flaw Began the Day It Was Disclosed
Exploit attempts against the Elementor Pro file upload flaw began the day it was disclosed, and one firewall alone blocked over 190,000 of them.
Security
A High-Severity Patch for Five Million WordPress Sites Was Labeled as a Text Fix
High-severity fixes for All-in-One WP Migration and Gravity Forms shipped August 20. One changelog called it a text fix, the other used a stock phrase.
Security
An Attacker Hijacked Hetzner IP Space and Poisoned a Virtualizor Update
An attacker hijacked routes to Softaculous servers for two nights, got a valid TLS certificate, and delivered a malicious update to some Virtualizor installs.
Security
cPanel Patches a Root-Level Flaw in Domain Parking: One Customer Account With Domain Permissions Was Enough
A cPanel customer able to add parked domains could gain root on the whole server. CVE-2026-65643 affects all supported versions; patches are out.
Reach hosting professionals
Sponsor webhosting.today and get in front of hosting buyers, founders and engineers.
50k+monthly readers
765articles