Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

Infrastructure & Hosting Alerts

Malicious Virtualizor Update Served via BGP Hijacking — Attackers diverted internet traffic to serve malicious updates to the Virtualizor VPS control panel [9].

• CVE / severity: No CVE assigned (Supply chain / BGP Hijack)
• Affected versions: All Virtualizor installations attempting updates between September 1–2, 2026.
• Fixed in: Clean update repository restored by vendor.
• Action now:
  • Inspect /usr/local/virtualizor for unauthorized file modifications.
  • Force a clean update using /usr/local/virtualizor/scripts/update.sh now that BGP routes have stabilized.
  • Check system logs for unauthorized SSH keys or new root users added during the 48-hour hijack window.

SonicWall SMA 1000 Series Under Active Exploit — Two critical flaws are being leveraged in the wild to compromise VPN appliances [13].

• CVE / severity: CVE-2026-9001 & CVE-2026-9002 (CVSS 9.8)
• Affected versions: SMA 1000 Series (6200, 6210, 7200, 7210, 8000v).
• Fixed in: Firmware versions released September 2, 2026.
• Action now:
  • Apply firmware updates immediately via the SonicWall support portal.
  • Enable Geo-IP filtering to block traffic from unexpected regions until patched.

JFrog Artifactory Admin Token Forgery — Flaw allows attackers to forge administrative tokens, gaining full control over artifact repositories [5, 12].

• CVE / severity: CVE-2026-6782 (CVSS 9.8)
• Affected versions: JFrog Artifactory versions prior to 7.77.x.
• Fixed in: Artifactory 7.77.5 / 6.27.30.
• Action now:
  • Upgrade Artifactory instances immediately.
  • Rotate all administrative access tokens and audit repository access logs for anomalous behavior [12].

WordPress & CMS Vulnerabilities

Massive Takeover Flaw in Popular Backup Plugin — A critical flaw allows remote attackers to gain full site control, impacting millions of WordPress installations [4, 5, 6].

• CVE / severity: CVE-2026-81294 (CVSS 9.8) [3].
• Affected versions: Widely used WordPress backup plugin (likely UpdraftPlus or similar based on "backup plugin" and "millions" identifiers in snippets [4, 5]).
• Fixed in: Not explicitly disclosed in snippets; check for latest plugin updates released in the last 24 hours.
• Action now:
  • Run wp plugin update --all or check specific backup plugin versions.
  • Verify that the plugin author is "Paul Ryan" or matches the CVSS entity listed [3].

Gitea Repository-to-RCE Active Exploitation — Repository write access can be escalated to full server command execution; now confirmed in CISA KEV [12].

• CVE / severity: CVE-2026-60004 (CVSS 9.9)
• Affected versions: Gitea versions prior to 1.22.0.
• Fixed in: Gitea 1.22.0 or later.
• Action now:
  • Update Gitea binary/container immediately.
  • Audit all users with "Write" permissions to ensure no unauthorized accounts were created.

Threat Landscape & Remediation

Sality P2P Botnet Takedown — International law enforcement has disrupted the 23-year-old Sality botnet, which targeted Windows servers and clients via P2P [10].

• Action: While the botnet is disrupted, infrastructure teams should continue to block known Sality P2P ports and update AV signatures to remove legacy infections that may still attempt to beacon [10].

Freelancer-Targeted Phishing (TVRAT) — A Russian national has been charged for a phishing campaign targeting freelancers with TVRAT malware to gain remote access to systems [7].

• Action: Infrastructure teams providing shared hosting or managed services for freelancers should monitor for TVRAT indicators of compromise (IoCs) and implement stricter SPF/DKIM/DMARC policies to mitigate phishing [7].