Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

🚨 CRITICAL SERVER & INFRASTRUCTURE UPDATES

PHP2Shell (CVE-2026-109618, CVE-2026-109619) — Botnet Integration & ASLR Bypass Active exploitation has escalated as Mirai botnet operators have integrated PHP2Shell exploits into their scanning infrastructure [11]. New research confirms the emergence of ASLR bypass techniques for these flaws, significantly increasing the reliability of Remote Code Execution (RCE) on modern Linux distributions [11].

• CVE / severity: CVE-2026-109618, CVE-2026-109619 (CVSS 9.8 Critical) [2]
• Affected versions: All PHP versions prior to 8.1.31, 8.2.25, and 8.3.13 [2][7]
• Fixed in: PHP 8.1.31, 8.2.25, and 8.3.13 [2]
• Action now:
  • Upgrade PHP immediately: dnf update php or apt-get upgrade php [2].
  • Verify protection using specialized PHP2Shell scanners to ensure WAFs are not providing a false sense of security [6].
  • Monitor for indicators of Mirai activity, specifically inbound traffic targeting PHP CGI/FPM endpoints [11].

Linux Kernel 'Copy Fail' (CVE-2026-31431) — Local Privilege Escalation A new local privilege escalation flaw in the Linux kernel allows unprivileged users to gain root access by exploiting the algif_aead crypto interface [14].

• CVE / severity: CVE-2026-31431 (High) [14]
• Affected versions: Linux kernel versions utilizing algif_aead (version range not fully disclosed) [14]
• Fixed in: Patch availability depends on distribution-specific backports [14]
• Action now:
  • Apply latest kernel updates via yum update kernel or apt upgrade linux-image-generic and reboot.
  • Restrict access to unprivileged users on multi-tenant hosting environments until patched.

cPanel/WHM Security Advisory (CVE-2026-115560) Infrastructure providers (notably Contabo) have issued alerts regarding a new vulnerability affecting cPanel and WHM installations [9].

• CVE / severity: CVE-2026-115560 (Severity under investigation) [9]
• Affected versions: cPanel/WHM installations [9]
• Fixed in: Not disclosed in sources; investigation ongoing [9]
• Action now:
  • Run /scripts/upcp to ensure the latest maintenance builds are installed.
  • Monitor cPanel security advisories for specific version fixes [9].

📦 SUPPLY CHAIN & AI INFRASTRUCTURE

LiteLLM Supply Chain Compromise Malicious packages were injected into LiteLLM via PyPI and Docker, potentially affecting AI-driven hosting middleware and backend services [12].

• CVE / severity: No CVE assigned (Supply Chain Attack) [12]
• Affected versions: Recent LiteLLM builds on PyPI and Docker Hub [12]
• Fixed in: Clean versions restored on official repositories [12]
• Action now:
  • Audit Python environments: pip list for litellm and check hashes against known-good releases.
  • Force-pull official Docker images and verify image signatures [12].

🧩 WORDPRESS & CMS VULNERABILITIES

LiteSpeed Cache Stored XSS — Mass Impact A high-priority Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability was disclosed in LiteSpeed Cache, affecting over 5 million active installations [3][10].

• CVE / severity: No CVE assigned (High Priority) [10]
• Affected versions: LiteSpeed Cache < 7.9.2 [10]
• Fixed in: Version 7.9.2 [10]
• Action now:
  • Update immediately: wp plugin update litespeed-cache [10].
  • Purge all cache layers to ensure no malicious scripts remain cached in the CDN/server-side [10].

WordPress Weekly Disclosure Surge Total disclosures for the past week have reached 497 vulnerabilities across 327 plugins and 23 themes, highlighting a severe spike in supply-chain risk [4].

• Action now:
  • Perform a bulk update of all plugins and themes.
  • Remove any plugins that have not been updated by their authors in over 12 months to mitigate the "vulnerability apocalypse" [1].