Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. Infrastructure & Hosting Provider Alerts

Jewelbug Campaign Targeting Hosting Providers — State-sponsored espionage actors (Jewelbug) are actively compromising shared hosting providers to execute watering-hole attacks. By gaining access to the provider level, they have successfully placed malicious scripts across every government tenant on the targeted infrastructure [7].

• Impact: Massive multi-tenant compromise; data exfiltration across government and telecom sectors.
• Action now: Audit all shared hosting administrative access; implement strict network segmentation between tenant environments; monitor for unauthorized modifications to web root directories at the server level.

cPanel/WHM Privilege Escalation (Phusion Passenger) — A vulnerability in Phusion Passenger's Watchdog API allows for privilege escalation on affected systems. While not impacting default cPanel installations, servers running custom Ruby/Node.js configurations via Passenger are at risk [8].

• CVE / Severity: No CVE assigned (reported via cPanel Security) / High.
• Affected versions: Installations utilizing Phusion Passenger via cPanel integration.
• Fixed in: Updates available via standard maintenance channels.
• Action now: Run /scripts/upcp to ensure all system binaries are current; if using Passenger, verify the API is not exposed to non-privileged users.

2. WordPress & CMS Vulnerabilities

The Wishlist Critical Authentication Bypass — A severe flaw in The Wishlist plugin allows unauthenticated users to gain unauthorized access to site functionality [4, 5].

• CVE / Severity: CVE-2026-12949 / 9.8 (Critical).
• Affected versions: The Wishlist (all versions prior to 2.1.0).
• Fixed in: Version 2.1.0.
• Action now: wp plugin update the-wishlist immediately.

User Session Synchronizer Auth Bypass — A vulnerability in the User Session Synchronizer plugin enables attackers to bypass authentication mechanisms [3].

• CVE / Severity: CVE-2026-15341 / 8.8 (High).
• Affected versions: Not disclosed in sources.
• Fixed in: Patched version available.
• Action now: Update the plugin to the latest version immediately and review session logs for unauthorized admin access.

Beaver Builder Stored XSS — The popular Beaver Builder plugin is vulnerable to Stored Cross-Site Scripting via its Button Module, allowing attackers to inject malicious scripts that execute in the context of other users [2].

• CVE / Severity: CVE-2026-17090 / 6.4 (Medium).
• Affected versions: Beaver Builder Page Builder (all versions prior to 2.8.3.4).
• Fixed in: Version 2.8.3.4.
• Action now: wp plugin update beaver-builder-lite-version (or Pro equivalent).

3. Emergent Global Threats

Domain Reputation Hijacking (Watering Hole 2.0) — Threat actors have spent approximately $7 million acquiring expired domains with high legacy reputation to host malware and scams. This bypasses many standard RBLs and reputation-based filters [11].

• Action now: Agencies should monitor their outgoing DNS logs for traffic to recently re-registered domains and update web filtering policies to scrutinize high-reputation domains that have recently changed ownership.

NetNut Seizure — The homepage of residential proxy provider NetNut has been seized by the FBI and IRS-CI. Infrastructure teams using this provider for scraping or proxy services should immediately discontinue use and audit associated credentials [6].