Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. Infrastructure & Hosting Provider Incidents

Data Breach at Russian Hosting Provider FirstVDS — Large-scale exfiltration of virtual server data and access credentials [9][13].

• CVE / Severity: No CVE assigned / Critical
• Affected versions: Infrastructure management systems at FirstVDS [9].
• Fixed in: External access to vulnerable management systems disabled as of 2026-10-19 [9].
• Action now:
  • Assume all data stored on FirstVDS virtual servers is compromised [9].
  • Immediately change all OS, database, and application passwords [13].
  • Rotate SSH keys and API credentials located on the affected servers [13].

ConnectWise Cloud Backup Suspended After Supply Chain Breach — Threat actors used compromised credentials to abuse Microsoft 365 access via a hosting provider IP (144.172.64[.]128) [10][12].

• CVE / Severity: No CVE assigned / Critical (Supply Chain Attack)
• Affected versions: ConnectWise Cloud Backup service integration with Microsoft 365 [12].
• Fixed in: Service suspended by vendor on 2026-10-19 to prevent further exploitation [10].
• Action now:
  • Monitor M365 logs for unauthorized logins from IP 144.172.64.128 [12].
  • Audit M365 application permissions and service principal activity [12].

2. Linux & Server Layer Vulnerabilities

Actively Exploited Linux Kernel RCE via cPanel & WHM — A critical kernel-level vulnerability affecting all major Linux distributions managed via cPanel/WHM is seeing active exploitation [14].

• CVE / Severity: Not disclosed in source (referencing October 19 NCSA alert) / Critical [14].
• Affected versions: All major Linux distributions used in hosting environments [14].
• Fixed in: Patches released by distribution maintainers (kernel update required) [14].
• Action now:
  • Run yum update kernel or apt-get upgrade linux-image-generic immediately.
  • Reboot servers to apply new kernel headers.
  • In cPanel, navigate to "Security Center" > "Security Advisor" to verify kernel status.

Linux KVM Sandbox Escape — A flaw in the KVM hypervisor allows attackers to escape virtual machine environments to the host [11].

• CVE / Severity: Not disclosed in source / High [11].
• Affected versions: KVM hypervisor components.
• Fixed in: Not disclosed in source; upstream patches pending/released [11].
• Action now: Update hypervisor packages on host nodes and restrict access to VM management interfaces.

3. WordPress & CMS Supply Chain Attacks

Rank Math PRO Supply Chain Compromise — Malware was injected into official plugin packages distributed between Oct 15 and Oct 16 [1].

• CVE / Severity: No CVE assigned / Critical (Malware Injection)
• Affected versions: Rank Math PRO packages downloaded/updated between 2026-10-15 and 2026-10-16 [1].
• Fixed in: Clean versions released after 2026-10-16 [1].
• Action now:
  • Check wp-content/plugins/seo-by-rank-math-pro/ for unauthorized code modifications.
  • Reinstall the plugin from a fresh download from the official vendor portal.

UpdraftCentral Connection Key Abuse — Compromised connection keys are being used to remotely install malicious plugins on WordPress sites [5].

• CVE / Severity: No CVE assigned / High
• Affected versions: Sites managed via UpdraftCentral with compromised keys [5].
• Fixed in: Key revocation and regeneration required [5].
• Action now:
  • Revoke all current UpdraftCentral connection keys.
  • Audit the site's plugin list for any unfamiliar or recently added plugins [5].

4. New WordPress Plugin CVEs

HivePress Remote Code Inclusion — Critical code injection flaw allows RCE [7][8].

• CVE / Severity: CVE-2026-110887 / 9.8 (Critical)
• Affected versions: HivePress <= 1.7 [7].
• Fixed in: HivePress 1.8.0 (assumed next version; source states 1.7 is vulnerable) [7].
• Action now: wp plugin update hivepress immediately or disable the plugin if no update is available.

YITH WooCommerce Wishlist Stored XSS — Vulnerability in input neutralization [6].

• CVE / Severity: CVE-2026-112199 / 6.1 (Medium)
• Affected versions: YITH WooCommerce Wishlist (version range not disclosed in source) [6].
• Fixed in: Not disclosed in source; check YITH repository for latest version [6].
• Action now: Update plugin and ensure a WAF is active to filter XSS payloads.