Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. WordPress CMS & Plugin Criticalities

Bricksforge Unauthenticated RCE via PHP Polyglot — A critical vulnerability allows unauthenticated attackers to execute arbitrary code by uploading malicious files disguised as valid formats (polyglots) [4].

• CVE / severity: CVE-2026-85097 | CVSS 9.8 (Critical)
• Affected versions: Bricksforge <= 3.1.8.9
• Fixed in: Latest available version (confirm via developer/repository) [4]
• Action now:
  • Update Bricksforge immediately.
  • Monitor for two-stage nonce-then-upload sequences targeting unauthenticated AJAX endpoints.

Bookly IDOR Leading to Data Disclosure/Deletion — An Insecure Direct Object Reference (IDOR) allows unauthenticated users to disclose or delete arbitrary booking tokens via the order_id parameter [7].

• CVE / severity: CVE-2026-93399 | CVSS 9.1 (Critical)
• Affected versions: Bookly <= 28.2
• Fixed in: Version 28.3 (or latest available)
• Action now:
  • wp plugin update booking-system-282 (or relevant slug).
  • Review access logs for unusual order_id parameter enumeration.

WordPress Core SQLi and DoS — Multiple vulnerabilities affect WordPress core, including a second-order SQL injection in the WXR (WordPress eXtended RSS) importer and a Denial of Service (DoS) in the URL handling method [1].

• CVE / severity: No CVE assigned (WordPress 7.0.x Branch)
• Affected versions: WordPress 7.0.x < 7.0.7
• Fixed in: WordPress 7.0.7
• Action now:
  • wp core update to version 7.0.7.
  • Specifically audit WP_Http::make_absolute_url() calls if using custom integrations.

2. Infrastructure, VPN & Network Security

Chinese Botnet (Integrity Technology Group) Targeting VPNs — CISA warns of Chinese government-linked actors using automated botnets to target VPN appliances and network infrastructure for persistent access [11].

• CVE / severity: Not specific to one CVE; uses automated exploit toolkits [11].
• Affected products: VPN appliances and network gateways.
• Action now:
  • Review CISA advisory AA26-281a for specific Indicators of Compromise (IoCs).
  • Implement strict Geo-IP blocking and MFA for all VPN entry points.

FortiGate Credential Exploitation ("FortiBleed") — The FBI issued a new warning that attackers are still actively using stolen FortiGate credentials to compromise infrastructure, exacerbated by compromised country-code domain registries which undermine HTTPS trust [8].

• Action now:
  • Force password resets for all administrative FortiGate accounts.
  • Audit SSL/TLS certificate validity for registry-level tampering.

3. Server-Side Data Incidents

Oracle Health/Cerner Legacy Server Breach — A massive breach affecting 20 million individuals was traced back to unauthorized access to legacy Cerner servers [9].

• Incident Scope: Initial access January 2025; identified March 2025 [9].
• Action now:
  • Audit and decommission legacy server environments that are no longer actively monitored.
  • Review internal network segmentation to prevent lateral movement from legacy tiers to production data.

4. Ecosystem & Industry Shifts

WordPress Security Funding Call — Executive Director Mary Hubbard has publicly called on major hosting providers (including GoDaddy and Newfold Digital) to begin funding the WordPress security program, which has been funded solely by Automattic since 2017 [3]. Hosting providers should anticipate potential changes in bug bounty responsibilities or upstream security support models.