Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. Infrastructure & Hosting Provider Critical Alerts

• Zeabur Infrastructure Shutdown — The hosting provider has announced it is shutting down following two catastrophic breaches in two months. The initial entry point was an unexpired admin token created in January 2024 that remained in plaintext [11].
• DreamHost FTP/Webmail Credential Leak — New disclosures confirm attackers maintained access to the DreamHost File Manager from August to October 23, 2026. Attackers exfiltrated FTP/SFTP usernames, passwords, and webmail session data for users who logged into the web interface during this window [12].
• cPGuard Supply Chain Attack Update — Confirmation that 3,000 Linux web hosting servers were infected via a compromised update infrastructure. The malicious update targeted servers running this security suite to gain root-level access [14].

Action Now:

• DreamHost Users: Immediately rotate all FTP, SFTP, and Webmail passwords. Terminate all active webmail sessions [12].
• cPGuard Users: Verify integrity of /usr/local/cpguard and check for unauthorized SSH keys or binary modifications [14].
• Hosting Admins: Audit all long-lived API tokens and ensure no administrative secrets are stored in plaintext [11].

2. WordPress Core & Mass Vulnerability Data

• WordPress Core Decadal Flaw — A high-severity flaw (CVE-2026-119977) has been identified affecting nearly a decade of WordPress releases. While a patch exists, researchers warn that the patching process itself may expose legacy configurations to new risks [1].
• Weekly Volume Surge — Threat intelligence reports 549 new vulnerabilities disclosed across 351 plugins in the last week, marking a significant spike in the attack surface for CMS-heavy hosting environments [3].

WordPress Core CVE-2026-119977 — Remote code execution and site compromise risk.

• CVE / severity: CVE-2026-119977 / 8.1 (High)
• Affected versions: WordPress 4.7 through 7.1.3 [1]
• Fixed in: WordPress 7.1.4 (or relevant security backports for older branches)
• Action now: Run wp core update. Verify file permissions after patching to ensure security hardening remains intact [1].

3. Active Plugin Exploits & Privilege Escalations

• Userplace Unauthenticated AJAX — A critical authorization bypass allows unauthenticated users to trigger AJAX actions that should be restricted to administrators [2][5].
• Fiber Admin Code Injection — A CWE-94 vulnerability allows unauthenticated remote attackers to execute arbitrary code via the plugin's administrative interface [6].

Fiber Admin Code Injection — Remote Code Execution (RCE).

• CVE / severity: CVE-2026-121491 / 9.8 (Critical)
• Affected versions: Fiber Admin 3.1.0 and prior [6]
• Fixed in: Not disclosed in sources; recommended to deactivate plugin [6]
• Action now: wp plugin deactivate fiber-admin. Block all POST requests to /wp-admin/admin-ajax.php that reference Fiber Admin functions if the plugin must remain active.

Userplace Privilege Escalation — Unauthorized access via AJAX.

• CVE / severity: CVE-2026-110963 / 9.8 (Critical)
• Affected versions: Userplace through 1.2.0 [2][5]
• Fixed in: Version 1.2.1 (if available, otherwise deactivate)
• Action now: wp plugin delete userplace. Audit wp_users table for new accounts created with administrative capabilities [5].