Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

⚠️ CRITICAL: INFRASTRUCTURE & HOSTING ALERTS

Acronis Linux Backup Plugin LPE — A high-severity local privilege escalation flaw in the Acronis backup agent for hosting control panels is seeing active exploitation. Attackers with low-level access can escalate to root, potentially compromising the entire server fleet [10][11].

• CVE / severity: CVE-2026-87886 (High)
• Affected versions: Acronis Linux backup integrations for cPanel & WHM and Plesk (versions not detailed in source)
• Fixed in: Acronis Agent for Linux v26.1.1 or higher [10]
• Action now:
  • Update Acronis Agent immediately via command line or the Acronis Cloud console.
  • Verify integrity of local backup configurations for unauthorized modifications.

cPanel/WHM Vulnerability Assessment — New exploit tooling has emerged targeting a specific vulnerability in cPanel/WHM environments, allowing for automated security bypasses [13].

• CVE / severity: CVE-2026-41940 (Severity not disclosed in sources)
• Affected versions: cPanel & WHM (vulnerability scope includes WP-integration components)
• Fixed in: Current stable releases (check /scripts/upcp status)
• Action now:
  • Run /scripts/upcp to ensure the latest security binaries are installed.
  • Monitor for unusual activity in /usr/local/cpanel/logs/access_log.

🚨 ACTIVE EXPLOITS: WORDPRESS & CMS

WooCommerce Wholesale Lead Capture Backdoor — Threat actors are actively exploiting this premium plugin to upload PHP backdoors. Once uploaded, these backdoors allow full site takeover and database exfiltration [1][2].

• CVE / severity: No CVE assigned (Critical)
• Affected versions: WooCommerce Wholesale Lead Capture (all versions prior to current patch)
• Fixed in: Latest plugin update available via developer
• Action now:
  • Check wp-content/uploads/ for unauthorized .php files.
  • Update the plugin immediately or deactivate if an update is unavailable.

The Events Calendar RCE Chain — Two independent vulnerability chains discovered in late August are now seeing wider disclosure. These allow unauthenticated attackers to reset admin credentials and execute OS-level commands [4][5].

• CVE / severity: CVE-2026-78006 (Critical)
• Affected versions: The Events Calendar <= 6.17.4
• Fixed in: The Events Calendar 6.17.5
• Action now:
  • wp plugin update the-events-calendar
  • Review WordPress user accounts for new, unauthorized Administrator roles.

Advanced Custom Fields: Extended PRO RCE — A high-priority vulnerability allows unauthenticated remote code execution, granting attackers the ability to run arbitrary code on the server [14].

• CVE / severity: No CVE assigned (High Priority)
• Affected versions: ACF Extended PRO <= 0.9.2.6
• Fixed in: 0.9.2.7
• Action now:
  • Update to the latest Pro version immediately.
  • Implement a WAF rule to block suspicious POST requests to ACF-related endpoints.

🛡️ CLOUD & DATA CENTER INCIDENTS

Cloud Service Key Exposure — A major breach at Klue has highlighted the risk of exposed cloud service keys, which allowed attackers to bypass traditional perimeters and extort data directly from cloud storage [8].

• Action now:
  • Audit all IAM roles and rotate long-lived cloud access keys (AWS/GCP/Azure).
  • Ensure secrets are not stored in plaintext within environment variables or code repositories.