Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

CRITICAL INFRASTRUCTURE & HOSTING ALERTS

U.S. Next Hosting Provider Outage — A major cyberattack has disrupted operations for U.S. Next, a regional hosting provider, causing downtime for numerous government and municipal websites across the United States [11].

• CVE / Severity: No CVE assigned / Critical Infrastructure Impact
• Affected versions: Infrastructure managed by U.S. Next
• Fixed in: Restoration in progress; not fully resolved as of report time
• Action now: Clients of U.S. Next should activate disaster recovery plans; other regional providers should audit perimeter defenses against similar DDoS or ransomware-style disruptions [11].

Next.js & React Multiple RCEs — Critical vulnerabilities in the Next.js framework allow for remote code execution via image processing and cache exploitation [4].

• CVE / Severity: CVEs pending / High (RCE)
• Affected versions: Next.js versions utilizing Server Actions or "use cache" directives (prior to October 2024 updates)
• Fixed in: Next.js 14.2.15+ or 15.0.0-canary.181+ [4]
• Action now: Upgrade via npm install next@latest; audit usage of Server Actions to ensure proper input validation [4].

SAP Cloud SDK Critical SSRF — A maximum-severity Server-Side Request Forgery vulnerability in SAP Cloud SDK for Python can lead to unauthorized internal network access [8].

• CVE / Severity: CVE-2026-89111 / 10.0 (Critical)
• Affected versions: SAP Cloud SDK for Python (all versions prior to 1.5.0)
• Fixed in: SAP Cloud SDK for Python 1.5.0
• Action now: Update Python environment dependencies immediately; rotate any cloud credentials that may have been exposed via metadata endpoints [8].

WORDPRESS & CMS THREATS

WordPress Core 'WP2Shell' Zero-Day — A rare and critical vulnerability in WordPress core, dubbed "WP2Shell," has been identified as a significant driver of Zero-Day Alerts (ZDAs) in Q3 2026, representing nearly 44% of all tracked incidents [1].

• CVE / Severity: No CVE assigned (referenced as WP2Shell) / Critical
• Affected versions: Not disclosed in sources (WordPress Core)
• Fixed in: Ongoing patching efforts; attackers are actively racing against standard change-management windows [1, 2]
• Action now: Implement immediate auto-update policies for core; monitor for unauthorized file creation in /wp-admin/ or root directories [1].

JTL-Connector for WooCommerce Arbitrary File Upload — A critical flaw allows unauthenticated attackers to upload malicious scripts directly to the server [6].

• CVE / Severity: CVE-2026-87855 / 9.8 (Critical)
• Affected versions: JTL-Connector for WooCommerce <= 2.4.3
• Fixed in: Not disclosed in sources; version 2.4.4+ recommended
• Action now: wp plugin update jtl-connector; if no update is available, deactivate the plugin immediately to prevent server shell access [6].

WPManageNinja Best Payments Plugin XSS — Improper neutralization of input allows for script injection, potentially leading to session hijacking for administrators [9].

• CVE / Severity: CVE-2026-108484 / 6.1 (Medium)
• Affected versions: All versions up to and including latest release
• Fixed in: Patch pending
• Action now: Implement a WAF rule to block suspicious scripts in payment-related POST requests [9].

EMERGING BOTNET TRENDS

Bot Migration Tactics — Following localized infrastructure outages (such as Yandex data centers), malicious bot traffic has not ceased but instead migrated to other hosting providers within 24 hours. Over 93% of tracked bot requests successfully transitioned to new infrastructure, showing high resilience [12].

• Action now: Infrastructure teams must monitor for sudden spikes in traffic originating from non-typical ASN ranges, as botnets are dynamically shifting targets to maintain uptime [12].