Tag: security

Plesk has patched three flaws reachable from an ordinary customer account. The worst can end at root, and its fix ships outside the core update.

ix major CDNs amplify attacker traffic toward the sites they front. Two have deployed mitigations, four are still discussing it.

Forminator's 9.8 file upload flaw was patched seventeen days before it went public, and the changelog shows eleven more fixes around it.

WordPress 7.0.4 fixes a flaw where an image hiding PostScript runs code on the server. It needs an author account, and multi-author sites should hurry.

Cloudflare for Government reached FedRAMP High on the same public network that serves everyone else. The Class D label is ahead of FedRAMP's calendar.

N-able's first fix missed a second route to the same flaw. Attackers are using it, and the new hotfix does not remove what they left behind.

Freenom, once the internet's biggest source of free phishing domains, has quietly returned, now charging money, two years after Meta sued it into retreat.

WordPress did the rare thing and forced a core security fix to millions of sites. Within 72 hours the break-ins started anyway. The gap is the story.

F5 patched a critical Nginx flaw (CVSS 9.2) latent since 2011. It only hits specific regex-map configs, and a proof-of-concept exploit is due in early August.

A flaw in WordPress core hands strangers the keys to your site, no password required, and attackers are already walking through the door. It is already being exploited.