Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

Infrastructure & Server Layer

Kubernetes Ingress-Nginx High-Severity RCE — A critical vulnerability in the Ingress-Nginx controller allows attackers to bypass security constraints and potentially achieve remote code execution (RCE) via manipulated headers or configurations [12].

• CVE / severity: CVE-2026-4342 / 8.8 (High)
• Affected versions: Versions < 1.13.9, < 1.14.5, and < 1.15.1
• Fixed in: 1.13.9, 1.14.5, or 1.15.1
• Action now:
  • Update Ingress-Nginx controller to the respective fixed version immediately.
  • Audit ingress resources for unauthorized annotations or custom snippets.

OpenSSH Agent Security Logic Bypass — A regression in OpenSSH 10.4 prevents the agent from properly distinguishing between local requests and those forwarded from remote servers when the agent is locked, potentially allowing unauthorized credential usage [8].

• CVE / severity: Not disclosed in sources
• Affected versions: OpenSSH 10.4
• Fixed in: Not disclosed in sources
• Action now:
  • Avoid using ssh-agent forwarding to untrusted remote hosts.
  • Use ssh -A with caution until a patch for 10.4 is deployed.

Cisco Firewall & Windows Kernel 0-Days — Active exploitation has been confirmed for Cisco firewall appliances and a Lazarus-linked Windows kernel vulnerability, posing risks to hybrid hosting environments [3].

• CVE / severity: Multiple (including Windows 0-day linked to Lazarus)
• Affected versions: Cisco Adaptive Security Appliance (ASA) and various Windows Server kernels
• Fixed in: Latest vendor security rollouts (August 2026 Patch Tuesday)
• Action now:
  • Apply Cisco ASA/FTD software updates immediately.
  • Execute sconfig or Update-Module on Windows-based infrastructure to apply August 2026 patches.

WordPress & CMS Applications

ProSolution WP Client Arbitrary File Upload — A critical flaw allows unauthenticated attackers to upload malicious files (including PHP shells) directly to the server, leading to full site takeover [5][6].

• CVE / severity: CVE-2026-16098 / CVSS not disclosed (Critical impact)
• Affected versions: All versions up to and including 2.0.10
• Fixed in: Not disclosed in sources; consider deactivating plugin if no update is available.
• Action now:
  • wp plugin deactivate prosolution-wp-client
  • Scan wp-content/uploads for unexpected .php files.

Kirki Freeform Page Builder Authorization Bypass — Attackers can bypass authorization checks to modify site layouts or inject content [1].

• CVE / severity: CVE-2026-18347 / Severity High
• Affected versions: All versions up to and including latest available
• Fixed in: Not disclosed in sources (Check for version > current)
• Action now:
  • Monitor for unauthorized changes in Kirki customizer settings.
  • Implement WAF rules to block unauthorized admin-ajax.php calls targeting Kirki hooks.

WordPress Core Author-Level RCE — A newly disclosed flaw allows users with 'Author' permissions to execute arbitrary code on the underlying server [14].

• CVE / severity: Not disclosed in sources (High/Critical)
• Affected versions: WordPress Core (versions not specified)
• Fixed in: Ensure core is on latest stable branch (e.g., 7.0.x or 6.x security releases)
• Action now:
  • wp core update
  • Audit all users with 'Author' or 'Editor' roles and demote unnecessary accounts.

Loco Translate Stored XSS — Vulnerability via PO file extracted comments allows attackers to execute scripts in the context of an administrator's browser [2].

• CVE / severity: CVE-2026-15066 / Severity Moderate
• Affected versions: All versions up to and including 2.8
• Fixed in: Update to version > 2.8
• Action now:
  • wp plugin update loco-translate
  • Restrict PO file upload capabilities to trusted administrators only.