Category: Security
82 articles
Security
Roundcube’s Zero-Click Webmail XSS, and How Fast It Reached cPanel
Roundcube's zero-click webmail XSS (CVSS 7.2) was patched July 5 and shipped in cPanel 134.0.45 on July 14. Here is what shared hosts should check.
Security
A US Sanction, a Montenegrin Domain, and Why Every t.me Link Went Dark
Every t.me link broke worldwide after the .me registry suspended Telegram's domain, a takedown whose trail leads to a US sanction and an American-run ccTLD.
Security
Januscape and Bad Epoll: Two Linux Flaws That Let One Customer Take Over the Whole Server
Two Linux kernel flaws, patched the same week, break the multi-tenant promise: one escapes a guest VM to the host, the other hands any local user root.
Security
Three Unauthenticated File Flaws in a Week, and One Root Cause: Validation by Shortcut
In one July week, three unauthenticated file-handling flaws surfaced across WordPress plugins and a web FTP client, all rooted in validation by shortcut.
Security
Hostinger Turns On Patchstack npm Scanning for Node.js Apps by Default
Hostinger built Patchstack's npm dependency scanning into its Node.js hosting, on by default, targeting the supply-chain risk of fast-shipped, AI-assisted apps.
Security
India’s .bank.in Trust Domain Leaked the Data of the People Who Run It
IDRBT, the registrar for India's anti-phishing .bank.in domain, exposed 5,576 bank-domain administrators' data through open APIs for 13 months.
Security
Europe’s Hosts Bundle Email to Keep Customers. One in Four Mailboxes Has No SPF.
A ShareShift audit of 56.3M European domains finds 3 in 4 run mail, but 1 in 4 mailboxes has no SPF, with Strato attaching mail to 94% of domains and protecting 6%.
Security
2,930 of 2,931 Exposed MySQL Databases Were Already Marked by Ransomware. The Playbook Is Six Years Old.
Researchers found 2,930 of 2,931 exposed MySQL databases marked by ransomware. Exposing a database to the internet is now a near-guarantee of compromise.
Security
An Attacker Sent a Ransom Email From Blesta’s Own Servers
An extortion email demanding Blesta pay up passed SPF, DKIM and DMARC from Blesta's own servers, pointing to a real compromise. Blesta has not confirmed one.
Industry reports
The File Nobody Watches: llms.txt Is the Hosting Industry’s Newest Attack Surface
Anyone can slip a fake support line or rogue download into a hosting firm's llms.txt, and AI agents repeat it as fact. Nothing on the domain is watching.
Reach hosting professionals
Sponsor webhosting.today and get in front of hosting buyers, founders and engineers.
50k+monthly readers
765articles