Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. Infrastructure & Server Layer: Critical Remote Code Execution

Cisco Firewall Management Center (FMC) Under State-Sponsored Attack — Sandworm (Russian GRU) and Qilin ransomware actors are actively exploiting a maximum-severity RCE to deploy espionage implants and ransomware [14].

• CVE / severity: CVE-2026-20079 (CVSS 10.0)
• Affected versions: Not explicitly disclosed in source; impacts Cisco Firewall Manager [14].
• Fixed in: Check Cisco Software Central for latest security updates [14].
• Action now:
  • Identify all internet-facing FMC instances immediately.
  • Apply vendor patches following Cisco advisory instructions.
  • Monitor for reverse shells and Qilin ransomware indicators of compromise (IoCs).

VMware vCenter RCE Exploited in the Wild — Attackers are leveraging a critical flaw to gain remote code execution, establishing persistence via reverse SSH tunnels [13].

• CVE / severity: CVE-2026-59310 (CVSS 9.8)
• Affected versions: Multiple VMware vCenter versions; specific range not disclosed in source [13].
• Fixed in: Patched versions released by VMware [13].
• Action now:
  • Update VMware vCenter Server immediately to the latest build.
  • Inspect outbound SSH traffic from vCenter appliances for unauthorized persistence tunnels.

Strad Solutions Ransomware Claim — The VEXY ransomware group has publicly targeted Strad Solutions, a hosting/dedicated server provider. While technical details and data proofs are currently withheld, providers should be alert to potential upstream supply chain risks [5].

2. WordPress & CMS: Critical Plugin Vulnerabilities

The Events Calendar Remote Code Execution — Multiple RCE vectors discovered in one of the most popular WordPress calendar plugins, involving unsafe widget instances and array parsing functions [1, 3].

• CVE / severity: CVE-2026-78159 (CVSS 9.8)
• Affected versions: All versions up to and including 6.17.3 [1, 3].
• Fixed in: 6.17.4 [3].
• Action now:
  • Run wp plugin update the-events-calendar immediately.
  • Verify that parse_array and is_safe_widget_instance functions are secured in the updated codebase.

Zonify Account Token Exposure — An authentication bypass allows unauthenticated users to retrieve the site’s stored account login tokens due to a lack of capability checks [2].

• CVE / severity: CVE-2026-87842 (CVSS Critical)
• Affected versions: Versions prior to 1.0.5 [2].
• Fixed in: 1.0.5 [2].
• Action now:
  • Update Zonify to version 1.0.5.
  • Rotate any linked account tokens or API keys as they may have been exposed.

3. Hosting Management & Supply Chain

Brevo (Sendinblue) Data Breach Impacts Users — A breach at the email service provider Brevo has led to the exposure of 347,000 user emails, specifically targeting Trezor users with highly effective phishing campaigns [4].

• Action now:
  • Infrastructure teams using Brevo/Sendinblue for transactional emails should audit mailing lists.
  • Educate customers on potential phishing attempts originating from legitimate-looking communication channels [4].

cPanel/WHM Security Baseline — Recent reports indicate a significant number of cPanel servers remain unpatched against vulnerabilities disclosed earlier this month. Modern installations are also triggering "Security Advisor" warnings regarding Roundcube login loops, which often mask underlying configuration drift or compromise [8, 10].

• Action now:
  • Execute /scripts/upcp to ensure the latest maintenance release is applied.
  • Review WHM Security Advisor results for "Red Badge" critical warnings immediately [10].