Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. INFRASTRUCTURE & HOSTING ALERTS

cPanel & WHM Unauthenticated Authentication Bypass (Active Zero-Day)
Massive exposure affecting an estimated 1.5 million servers. Hosting provider data confirms this was exploited as a zero-day for 64 days prior to public disclosure [9]. Attackers can bypass authentication to gain unauthorized access to server management interfaces.

• CVE / severity: CVE-2026-41940 | CVSS 9.8 (Critical)
• Affected versions: cPanel & WHM versions prior to 120.0.12, 118.0.21, and 110.0.32 [9, 14]
• Fixed in: 120.0.12, 118.0.21, 110.0.32
• Action now:
  • Execute /usr/local/cpanel/scripts/upcp immediately to force update.
  • Review /var/cpanel/updatelogs/ for update status and access logs for unauthorized logins.

cPanel Authenticated Privilege Escalation to Root
A critical flaw allows a standard hosting customer with domain control permissions to escalate privileges and execute arbitrary code as the root user [10].

• CVE / severity: CVE-2026-65643 | CVSS 9.9 (Critical)
• Affected versions: All versions prior to the August 2026 security patch [10, 14]
• Fixed in: See official cPanel security advisory (AV26-861) for specific build targets.
• Action now:
  • Update cPanel/WHM to the latest tiered release (Current/Edge/Stable).
  • Audit accounts with custom DNS or domain management permissions.

2. CRITICAL WORDPRESS PLUGIN VULNERABILITIES

GiveWP Unauthenticated Remote Code Execution (RCE)
A maximum-severity PHP Object Injection flaw exists in the "safe" unserialize function. Attackers can inject malicious serialized data to execute arbitrary commands on the underlying hosting server [1, 4, 8].

• CVE / severity: CVE-2026-82222 | CVSS 10.0 (Critical)
• Affected versions: GiveWP ≤ 4.16.7.1
• Fixed in: GiveWP 4.16.8
• Action now:
  • Run wp plugin update give immediately.
  • If unable to update, disable the plugin and audit wp-content/uploads for suspicious PHP scripts or web shells.

WPMU DEV Dashboard Authentication Bypass
A flaw in the dashboard plugin allows unauthenticated attackers to gain administrative access to the WordPress site [2, 7].

• CVE / severity: CVE-2026-76581 | CVSS Score Not Disclosed (Critical impact)
• Affected versions: WPMU DEV Dashboard ≤ 5.0.1
• Fixed in: WPMU DEV Dashboard 5.0.2
• Action now:
  • Update via the WPMU DEV Hub or WordPress admin panel.
  • Check for unauthorized new administrator accounts.

3. ACTIVE SUPPLY CHAIN & CMS THREATS

Duplicate Post Authentication Bypass
Exploitation of this vulnerability allows unauthorized users to bypass authentication mechanisms within the CMS workflow [5].

• CVE / severity: CVE-2026-19085 | CVSS Not Disclosed
• Affected versions: Duplicate Post (specific version range not disclosed in source)
• Fixed in: Update to the latest available version via WP-CLI or Admin.
• Action now:
  • Monitor for unauthorized post/page duplication or modification.

Avada (Fusion) Builder Stored XSS
Authenticated users with Contributor-level permissions can inject malicious scripts via the 'size' shortcode attribute, leading to site takeover if an admin views the affected content [3].

• CVE / severity: CVE-2026-16654 | CVSS 6.4 (Medium)
• Affected versions: Avada Fusion Builder ≤ 3.15.6
• Fixed in: Avada Fusion Builder 3.15.7
• Action now:
  • Update the Avada theme and its required "Fusion Builder" plugin immediately.

JetBrains Cadence Data Exposure Incident
Investigation confirmed unauthorized access to the Cadence service, resulting in the exposure of customer data [11]. Teams using JetBrains infrastructure should monitor for further advisories.

• Action now: Rotate credentials associated with JetBrains Cadence service accounts.