Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. WordPress Ecosystem: Bricksforge Active Exploitation

Reports indicate that threat actors have begun active exploitation of a critical unauthenticated arbitrary file upload vulnerability in the Bricksforge plugin [2][4]. This flaw allows attackers to upload malicious scripts directly to the server, leading to full Remote Code Execution (RCE) [3]. Additionally, new patch matrix data clarifies the scope of the recent WordPress core backports for the CVE-2026-87902 security release [5].

Bricksforge Unauthenticated RCE

• CVE / severity: CVE-2026-85097 | CVSS 9.8 (Critical)
• Affected versions: Bricksforge <= 0.9.9.9
• Fixed in: Version 0.9.9.10 (or later)
• Action now:
  • Update immediately via wp plugin update bricksforge.
  • Audit the wp-content/uploads directory for suspicious PHP files.
  • Implement WAF rules to block POST requests to plugin endpoints from unknown IPs.

2. Infrastructure & Hosting: Ghostscript PDF Hijacking

A critical flaw in Ghostscript, a common backend for rendering PDFs and images on Linux servers, is being used to hijack servers via PDF uploads [13]. While standard WordPress configurations restrict Media Library access, any application or plugin using Ghostscript for PDF processing (e.g., invoice generators, thumbnailers) is at high risk [13].

Ghostscript Command Injection

• CVE / severity: No CVE assigned in source (referenced as Ghostscript flaw) | Critical
• Affected versions: Most standard Linux distributions using Ghostscript for document processing.
• Fixed in: Latest upstream Ghostscript security releases (check distro-specific repos).
• Action now:
  • Disable Ghostscript processing for untrusted PDF/EPS files in /etc/ImageMagick-6/policy.xml by setting the PDF coder to rights="none".
  • Run yum update ghostscript or apt-get install --only-upgrade ghostscript.

3. Network & Security Appliances: Check Point & Atlassian

Check Point Quantum Security Management tools are facing two critical vulnerabilities that allow unauthenticated attackers to gain unauthorized access [12]. Simultaneously, Atlassian Data Center products are now being targeted in the wild following a newly disclosed flaw [1].

Check Point Quantum Security Management

• CVE / severity: CVE-2026-91843 | CVSS 9.8 (Critical)
• Affected versions: Check Point Quantum Security Management (specific versions not disclosed in source).
• Fixed in: October 2026 Security Updates.
• Action now:
  • Apply vendor-provided patches via the Check Point Management Console.
  • Restrict management interface access to trusted IP ranges only.

4. Incident Watch: Supply Chain & Regional Outages

• Government Web Hosting: A cyberattack on a web service firm serving Mississippi local governments has caused prolonged downtime for several county websites, though data breaches have not yet been confirmed [10].
• Enterprise Infrastructure: Global retail giant Ahold Delhaize and TFG London both reported significant cybersecurity incidents in the last 24 hours, forcing systems offline to contain the spread [7][9].
• SAP/ERP Vulnerabilities: SAP has released critical patches for Cloud SDK for Python and NetWeaver; hosting providers managing SAP environments should prioritize these updates immediately [6].