Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. WordPress Ecosystem: Critical RCE in Elementor Pro

Two high-impact file upload vulnerabilities have been disclosed, both allowing unauthenticated remote code execution (RCE) via malicious PHP uploads.

Elementor Pro Critical File Upload [1][5][12]

• CVE / severity: CVE-2026-32475 | CVSS 9.0 (Critical)
• Affected versions: Elementor Pro <= 4.2.1
• Fixed in: Elementor Pro 4.2.2 (estimated based on standard patching, check vendor dashboard)
• Action now:
  • Update Elementor Pro to the latest available version immediately.
  • Check for suspicious files in /wp-content/uploads/elementor/forms/ following the pattern <13-hex-chars>.php.
  • Restrict execution of PHP files within the /uploads/ directory via .htaccess or Nginx configuration.

Forminator Forms RCE [2]

• CVE / severity: CVE-2026-15748 | Critical
• Affected versions: Forminator <= 1.29.0 (check specific version strings in plugin readme)
• Fixed in: Latest patched version (noted as available in sources)
• Action now:
  • wp plugin update forminator
  • Verify all form upload fields are restricted to specific, non-executable extensions (e.g., .jpg, .pdf).

Broken Link Checker Information Disclosure [4]

• CVE / severity: CVE-2026-18937 | High
• Affected versions: Broken Link Checker < 2.4.12
• Fixed in: 2.4.12
• Action now: Update the plugin to 2.4.12 to prevent manipulation of query variables on sites using plain permalinks.

2. Infrastructure & Hosting: Shared Hosting Breach & Kernel Risks

Active exploitation of shared hosting environments and kernel vulnerabilities remain a primary threat to infrastructure teams.

Shared Hosting Script Injection Breach [9]

• Threat: A China-based threat actor successfully compromised a shared hosting platform by injecting a single script tag into the common infrastructure.
• Impact: Exposed webmail accounts for 15 government tenants residing on the shared server.
• Action now:
  • Audit shared libraries and scripts globally across multi-tenant environments.
  • Implement strict subresource integrity (SRI) and Content Security Policy (CSP) headers to prevent unauthorized script execution.

cPanel & WHM Linux Kernel Vulnerability [10]

• CVE / severity: no CVE assigned in snippet (related to June/August 2026 advisory chain)
• Affected versions: All major Linux distributions running cPanel & WHM.
• Fixed in: Latest kernel updates provided via OS vendor channels.
• Action now:
  • Run /scripts/upcp to ensure cPanel binaries are current.
  • Execute dnf update or apt upgrade followed by a reboot to apply latest kernel patches for local privilege escalation and auth bypass mitigations.

3. Authentication & Perimeter: 155x Surge in Password Spraying

Infrastructure teams are seeing a massive shift in how brute-force attacks are executed against mail and management portals.

Advanced Password Spraying Campaign [14]

• Threat: A 155-fold increase in password spraying has been recorded in early 2026, specifically targeting gaps in Multi-Factor Authentication (MFA) implementation.
• Impact: High-volume credential validation against IMAP, SMTP, and webmail portals.
• Action now:
  • Disable legacy authentication protocols (IMAP/POP3) that bypass MFA.
  • Implement account lockout policies and IP rate-limiting for failed login attempts at the firewall or load-balancer level.
  • Audit logs for "single-try" login attempts across a wide range of usernames from rotating residential IP addresses.