Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. SERVERS & INFRASTRUCTURE: Critical OpenSSH & Linux Exploitation

OpenSSH Use-After-Free (UAF) Host Key Vulnerability — A remote attacker can trigger a use-after-free condition during key re-exchange, potentially leading to code execution or service compromise [11][12].

• CVE / severity: CVE-2026-3568 (CVSS not explicitly scaled in source, rated 'Critical' by openEuler) [11]
• Affected versions: OpenSSH versions prior to 10.4 [11]
• Fixed in: OpenSSH 10.4; openEuler 24.03 LTS SP4 (openssh-9.6p1-13.oe2403sp4) [12]
• Action now:
  • Upgrade OpenSSH to 10.4 or higher immediately.
  • On openEuler: dnf update openssh [11].
  • Audit server logs for unexpected host key change events during active sessions.

Fire Ant Nexus: Infrastructure & Hypervisor Espionage — A China-nexus threat actor (Fire Ant) is actively targeting Linux management hosts, hypervisors, and routers to establish persistent GRE tunnels for intelligence collection [7][13].

• CVE / severity: No specific CVE assigned (TTP-based campaign) [13]
• Affected versions: Linux management hosts and virtualization infrastructure [13]
• Fixed in: N/A (Persistence remediation required)
• Action now:
  • Check /var/log/secure for repeated sshd: error: connect_to ... port ... failed entries [13].
  • Identify unauthorized GRE tunnel configurations (ip tunnel show) on non-network devices [13].
  • Verify integrity of hypervisor management interfaces.

2. WORDPRESS & CMS: Admin Takeovers & Social Engineering

MyHome Core Authentication Bypass — A critical flaw in the MyHome Core plugin allows unauthenticated attackers to bypass security checks and gain full administrative access to the WordPress site [4].

• CVE / severity: CVE-2026-15980 / CVSS 9.8 (Critical) [4]
• Affected versions: MyHome Core plugin versions ≤ 4.4.5 [4]
• Fixed in: Not disclosed in sources; assume > 4.4.5 or plugin deactivation [4]
• Action now:
  • Immediately check for the presence of the myhome-core plugin.
  • Deactivate or update to the latest version via wp plugin update myhome-core if a patch is confirmed locally.
  • Review user lists for unauthorized administrator accounts.

TerminalFix "Cloudflare" Social Engineering Campaign — Attackers are overlaying fake Cloudflare CAPTCHA prompts on compromised sites. Unlike previous iterations, these prompts now use a new social engineering method to trick users into executing malicious scripts directly on their local machines [1][3].

• CVE / severity: No CVE assigned [1]
• Affected versions: Any WordPress site with JS-injection vulnerabilities [1]
• Fixed in: Site-level malware cleanup [1]
• Action now:
  • Monitor for unauthorized JavaScript injections adding overlays or CAPTCHA-like divs.
  • Implement Content Security Policy (CSP) to restrict script execution to trusted domains.

3. CROSS-PLATFORM & SUPPLY CHAIN

PaperCut Emergency Update — A second wave of emergency patches has been released for PaperCut software, widely used in managed print environments, following active exploitation of critical vulnerabilities [10].

• CVE / severity: CVE-2026-82078 and CVE-2026-81578 [10]
• Affected versions: Not explicitly listed in source; check PaperCut advisory [10]
• Fixed in: Latest PaperCut emergency patch releases [10]
• Action now:
  • Apply the second emergency patch from PaperCut immediately.
  • Isolate print servers from the public internet if patching is delayed.