Category: Security

Two critical PHP flaws leaked before the October 21 security release at 14:00 UTC. What is known and what hosts can prepare.

On October 19, for up to 94 minutes, five OVHcloud CLI releases served a binary designed to retrieve secrets from disk.

Roundcube 1.6.20 and 1.7.5 fix 20 security flaws, the largest of five security rounds since 1.7.0. cPanel and Plesk ship the 1.6 branch.

A Linux kernel networking flaw can let a virtual machine read its host's memory. Found in Vercel's sandbox challenge, it is fixed in kernels from October 15.

nginx 1.30.6 and 1.31.7 fix five vulnerabilities that depend on how nginx is configured, in the eighth round of nginx security fixes this year.

Vercel paid $50,000 for a guest-to-host-root KVM escape found in its Firecracker sandbox. No CVE, kernel range or patch is public, and every VPS fleet runs KVM.

Attackers are targeting Ninja Forms and WPC Product Bundles with a payload built to hide its own WordPress admin and outlast plugin removal.

HostGator and Monarx recorded more than 51 million proactive security actions in Brazil between March and August 2026.

The flaw WordPress patched in 7.1.2 was under attack the day the fix shipped and is on CISA's KEV list. Code execution needs two host-side conditions.

An authenticated cPanel account holder could run code as root through CalDAV and CardDAV. Three builds carry the fix, dated September 22.