Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

⚠️ Critical Server & Infrastructure Alerts

Windows Kernel Driver Zero-Day — Active Exploitation by Lazarus Group An actively exploited zero-day in the Windows kernel driver is being used in targeted attacks (Operation Dream Job). Additionally, four unauthenticated RCE flaws (CVSS 9.8) affect core infrastructure services including DNS Server and QUIC [14].

• CVE / severity: CVE-2026-68820 (Zero-day) / Critical
• Affected versions: Windows Server 2016, 2019, 2022, 2025, and various desktop versions [14]
• Fixed in: August 2026 Patch Tuesday updates [14]
• Action now:
  • Run wuauclt /detectnow or use WSUS/SCCM to deploy August 11/12 patches immediately.
  • Prioritize patching of Windows DNS Servers and Deployment Services due to unauthenticated RCE risk [14].

ShieldBreak PoC — Bypassing RoguePlanet Fix on Server 2025 A new Proof-of-Concept (PoC) named "ShieldBreak" has been released, claiming a total bypass of the recent patch for CVE-2026-50656. This allows attackers to circumvent Microsoft's security mitigations on the latest server builds [13].

• CVE / severity: CVE-2026-50656 Bypass / Critical
• Affected versions: Windows Server 2025 (patched and unpatched) [13]
• Fixed in: Not disclosed in sources (patch bypass) [13]
• Action now:
  • Monitor for unusual system-level process spawning.
  • Implement strict EDR monitoring for unauthorized driver or kernel-level modifications.

cPanel & WHM — Database Privilege Escalation A critical vulnerability allows authenticated users to execute SQL statements with full database privileges, potentially leading to complete server compromise or data exfiltration [8][9].

• CVE / severity: CVE-2026-58048 / 9.8 Critical [9]
• Affected versions: All supported versions of cPanel & WHM prior to security release [8]
• Fixed in: Latest security updates (refer to cPanel internal changelog) [8]
• Action now:
  • Run /scripts/upcp immediately to ensure the latest security tier is applied.
  • Verify that automatic updates are enabled in WHM > Update Preferences.

🛠️ WordPress & CMS Vulnerabilities

WordPress Core — Multiple Vulnerabilities in 7.0.x WordPress 7.0.3 has been released to address multiple security issues, including Author-level CSS injection and Contributor-level stored XSS via emoji processing [3].

• CVE / severity: Multiple / Medium to High
• Affected versions: WordPress 7.0.x < 7.0.3 [3]
• Fixed in: WordPress 7.0.3 [1][3]
• Action now:
  • Update to WordPress 7.0.3 immediately using wp core update or the Dashboard.
  • Audit CSS safe-attribute filters if using custom sanitization logic [3].

Formidable Digital Signatures — Arbitrary File Deletion A vulnerability in this plugin allows for the deletion of arbitrary files on the server, which can be used to disrupt site availability or delete critical configuration files [5].

• CVE / severity: CVE-2026-16230 / High
• Affected versions: Not disclosed in sources [5]
• Fixed in: Not disclosed in sources (Check plugin repository for latest version) [5]
• Action now:
  • Update Formidable Digital Signatures plugin via wp plugin update formidable-pro-signatures.
  • Monitor server logs for unexpected unlink() or file deletion events.

BdThemes — Ongoing Supply Chain Response Reports continue to circulate regarding poisoned JSON in seven BdThemes plugins that create rogue administrators and install web shells [4]. Agencies are advised to re-audit sites using these tools.

• CVE / severity: No CVE assigned / Critical
• Affected versions: Seven BdThemes plugins (including Element Pack) [4]
• Fixed in: Recent vendor patches [4]
• Action now:
  • Audit the wp_users table for unauthorized administrator accounts.
  • Scan for web shells in plugin directories using tools like Wordfence or Sucuri.