Tag: security

WordPress 7.0.4 fixes a flaw where an image hiding PostScript runs code on the server. It needs an author account, and multi-author sites should hurry.

Cloudflare for Government reached FedRAMP High on the same public network that serves everyone else. The Class D label is ahead of FedRAMP's calendar.

N-able's first fix missed a second route to the same flaw. Attackers are using it, and the new hotfix does not remove what they left behind.

Freenom, once the internet's biggest source of free phishing domains, has quietly returned, now charging money, two years after Meta sued it into retreat.

WordPress did the rare thing and forced a core security fix to millions of sites. Within 72 hours the break-ins started anyway. The gap is the story.

F5 patched a critical Nginx flaw (CVSS 9.2) latent since 2011. It only hits specific regex-map configs, and a proof-of-concept exploit is due in early August.

A flaw in WordPress core hands strangers the keys to your site, no password required, and attackers are already walking through the door. It is already being exploited.

Cloudways now lets AI agents run almost your whole hosting account by chat. Its role-based tokens are a rare guardrail in a category where MCP security lags.

Two Linux kernel flaws, patched the same week, break the multi-tenant promise: one escapes a guest VM to the host, the other hands any local user root.

In one July week, three unauthenticated file-handling flaws surfaced across WordPress plugins and a web FTP client, all rooted in validation by shortcut.