Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. Infrastructure & Hosting Layer

cPanel Mail Privilege Escalation to Root — A critical flaw allows users with mail-level privileges to bypass filesystem restrictions and execute arbitrary code as the root user [11].

• CVE / severity: CVE-2026-67401 (CVSS 9.8 Critical)
• Affected versions: cPanel & WHM versions prior to 122.0.12, 118.0.25, and 110.0.40
• Fixed in: 122.0.12, 118.0.25, 110.0.40
• Action now:
  • Run /scripts/upcp immediately to update to the latest patched tier.
  • Audit accounts with custom mail configurations or large numbers of forwarders/aliases.

Check Point VPN Remote Code Execution — Two critical vulnerabilities in Check Point security gateways allow unauthenticated attackers to achieve full RCE on the appliance [9].

• CVE / severity: CVE-2026-85102 & CVE-2026-85103 (CVSS 9.8 Critical)
• Affected versions: Quantum Security Gateway and Spark appliance firmware (multiple versions)
• Fixed in: Check Point R81.10, R81.20, and R80.40 Jumbo Hotfix Accumulators (specific builds not disclosed in source)
• Action now:
  • Apply the latest Jumbo Hotfix Accumulator via Gaia Portal or CLI.
  • Restrict VPN portal access to known-good IP ranges where possible.

Fortinet PivotC2 RAT Exploitation — Active exploitation of a Fortinet RCE vulnerability is being used to deploy the PivotC2 Remote Access Trojan (RAT) in infrastructure environments [7].

• CVE / severity: CVE-2025-25249 (CVSS not disclosed, confirmed active exploitation)
• Affected versions: FortiOS and FortiProxy (various versions)
• Fixed in: Latest firmware releases (check FortiGuard advisory for specific branch fixes)
• Action now:
  • Verify FortiOS firmware versions; upgrade immediately if on an affected branch.
  • Monitor for outbound traffic to suspicious C2 infrastructure associated with PivotC2.

2. WordPress / CMS Supply Chain

Ninja Forms Arbitrary File Upload & RCE — A critical vulnerability in the file upload module allows unauthenticated attackers to upload PHP shells to the server [5].

• CVE / severity: CVE-2026-0740 (CVSS 9.8 Critical)
• Affected versions: Ninja Forms File Uploads extension versions prior to 3.3.22
• Fixed in: 3.3.22
• Action now:
  • wp plugin update ninja-forms-uploads
  • Emergency Mitigation: Add an Nginx/Apache rule to block PHP execution in the uploads directory: location ~* ^/wp-content/uploads/.*\.(php|phtml|php[0-9]?|phar)$ { return 403; } [5].

Drag and Drop File Upload for Elementor Forms — Similar to the Ninja Forms flaw, this plugin allows unauthenticated arbitrary file uploads, potentially leading to full site takeover [6].

• CVE / severity: CVE-2026-18351 (CVSS 9.8 Critical)
• Affected versions: All versions up to and including 1.6.8
• Fixed in: Not disclosed in sources; assume all current versions are vulnerable if above 1.6.8 is not available.
• Action now:
  • Disable the plugin until a patch is verified.
  • Inspect wp-content/uploads/wp_dnd_uploads for unauthorized PHP files.

WPLP Cookie Consent Settings Hijack — Insufficient protection on AJAX actions allows attackers to modify plugin settings, which can lead to XSS or site redirection [3].

• CVE / severity: CVE-2026-85133 (CVSS 7.5 High)
• Affected versions: Versions before 4.4.2
• Fixed in: 4.4.2
• Action now:
  • wp plugin update wplp-cookie-consent

3. Active Indicators & Hardening

• Product Filter for WooCommerce XSS: CVE-2026-7804 impacts the wpf_fid parameter in all versions up to current; sanitize inputs and update once a patch is confirmed by WBW [2].
• Persistence Check: Infrastructure teams should audit wp-content/mu-plugins for unfamiliar files, as attackers are increasingly using "Must-Use" plugins to hide shells from standard dashboards [5].
• Supply Chain Warning: The "Hugging Face mob agent" incident highlights that infrastructure flaws are being chained to reach host-level control; hosting providers should ensure strict isolation between containerized AI agents and host kernels [12].