Category: Security

InMotion is deploying Monarx ThreatShield across its server fleet, moving attack blocking into the PHP engine itself.

Plesk has patched three flaws reachable from an ordinary customer account. The worst can end at root, and its fix ships outside the core update.

ix major CDNs amplify attacker traffic toward the sites they front. Two have deployed mitigations, four are still discussing it.

Forminator's 9.8 file upload flaw was patched seventeen days before it went public, and the changelog shows eleven more fixes around it.

A critical VMware flaw may let a guest VM run code on the ESX host, and Broadcom ships no workaround for it.

WordPress 7.0.4 fixes a flaw where an image hiding PostScript runs code on the server. It needs an author account, and multi-author sites should hurry.

A CVSS 10 flaw let attackers become Metabase admins without logging in. Cloud instances were patched by the vendor. Self-hosted ones were not.

Cloudflare for Government reached FedRAMP High on the same public network that serves everyone else. The Class D label is ahead of FedRAMP's calendar.

Zapscape lets one tenant break out and take over the whole Linux server. A box running no VMs at all can still be in range.

Roundcube patched eleven flaws in 1.7.3 and 1.6.18. The notes carry no CVE numbers, and cPanel has not shipped the update yet.