Category: Security

WordPress 7.1.1 was planned as bug-fix only and shipped with 11 security fixes, one an anonymous comment XSS the sanitizer does not catch.

A CVSS 9.8 flaw sits under WordPress photo uploads, in a system library the host has to patch. Twenty days after the fix, it has no CVE number.

LiteSpeed Enterprise 6.3.7 shipped three security builds in six days, after a cPanel advisory on a root path from a hosting account. Build 2 is the one to run.

Acronis patched a privilege-escalation flaw in its cPanel backup plugin and reports limited attacks. CISA listed it with a September 19 deadline.

Six months after disclosure, a WooCommerce extension is still drawing blocked exploit attempts. The largest spike came on August 30.

The EU now requires software makers to report actively exploited flaws within 24 hours, and a GPL plugin with a paid tier counts as a product.

Monarx has launched a white-label dark web monitoring service for hosts. It starts from a domain and shows the categories of breached data, not the values.

cPanel has patched CVE-2026-67401, a flaw rated 9.9 out of 10 that let an authenticated account with mail privileges run code as root.

An unpatched Magento flaw has been exploited since September 4. The first known victim had a clean patch status, and the backdoor installs outside the web root.

WHMCS fixed an unauthenticated RCE and a 2CheckOut data disclosure flaw in 9.0.8 and 8.13.7. Installations on 8.0 through 8.12 have no patch and must upgrade.