Tag: security

Cloudways now lets AI agents run almost your whole hosting account by chat. Its role-based tokens are a rare guardrail in a category where MCP security lags.

Two Linux kernel flaws, patched the same week, break the multi-tenant promise: one escapes a guest VM to the host, the other hands any local user root.

In one July week, three unauthenticated file-handling flaws surfaced across WordPress plugins and a web FTP client, all rooted in validation by shortcut.

Hostinger built Patchstack's npm dependency scanning into its Node.js hosting, on by default, targeting the supply-chain risk of fast-shipped, AI-assisted apps.

An extortion email demanding Blesta pay up passed SPF, DKIM and DMARC from Blesta's own servers, pointing to a real compromise. Blesta has not confirmed one.

Anyone can slip a fake support line or rogue download into a hosting firm's llms.txt, and AI agents repeat it as fact. Nothing on the domain is watching.

CVE-2026-49261 scores CVSS 10.0 and allows unauthenticated RCE in MariaDB Galera Cluster deployments. Standalone installations are not affected. Patches shipped May 27.

WordPress.org made the 24-hour plugin auto-update delay default for every new release on June 5, 2026. Mullenweg calls it Protect The Shire.

Single-connection HTTP/2 attack crashes web servers. nginx is patched today; Apache's fix has not reached distribution package managers.

A dataset allegedly from Home.pl, Poland's largest hosting provider, is being advertised on a cybercrime forum. We analyze the schema and what it means for 300,000+ customers.