Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

Infrastructure & Server-Layer Threats

Linux Kernel UDP Socket Flaw — Remote crash and potential memory corruption via malformed UDP packets.

• CVE / severity: CVE-2026-98276 | High
• Affected versions: Multiple Linux kernel versions; specifically identified in CloudLinux and common server distributions [13].
• Fixed in: Current kernel security patches (CloudLinux and upstream) [13].
• Action now:
  • Update kernel via dnf update kernel or yum update and reboot.
  • Check for crash indicators using: journalctl -k -b -1 | grep -E 'inet_sock_destruct|udp_destruct_common|__sk_mem_raise_allocated|__udp_enqueue_schedule_skb' [13].

DreamHost Infrastructure Breach Escalation — Leak of plaintext FTP/SFTP and webmail credentials.

• CVE / severity: no CVE assigned | Critical
• Affected versions: All accounts active during the breach period [10].
• Fixed in: Infrastructure remediation complete, but credentials remain compromised until rotated [10].
• Action now:
  • Enforce mandatory SFTP/FTP and Webmail password resets for all hosted users.
  • Audit all WordPress wp-config.php and .htaccess files for unauthorized modifications or backdoors [10].

GitHub/Gmail OAuth & Credential Targeting — Cluster of unauthorized access attempts targeting developer accounts.

• CVE / severity: no CVE assigned | High
• Affected versions: Developer accounts using linked Gmail/GitHub credentials [11].
• Action now:
  • Audit authorized OAuth applications in GitHub and Google account settings.
  • Enable hardware-based 2FA (Yubikey) for infrastructure management accounts [11].

WordPress CMS & Plugin Exploitation

WPJAM Basic Privilege Escalation — Unauthenticated attackers can elevate privileges to Administrator [5].

• CVE / severity: CVE-2026-103900 | 9.8 (Critical)
• Affected versions: WPJAM Basic <= 7.1
• Fixed in: Not disclosed in sources; recommended to deactivate [5].
• Action now:
  • wp plugin deactivate wpjam-basic until a patch is confirmed.

LatePoint Appointment Booking Auth Bypass — Flaw in account management allowing unauthorized access [6].

• CVE / severity: CVE-2026-118066 | 8.8 (High)
• Affected versions: LatePoint (versions not specified in source) [6].
• Action now:
  • Check for updates in the LatePoint dashboard or vendor portal.

Registration Form for WooCommerce Privilege Escalation — Missing allow-list check allowing user-to-admin escalation [7][8].

• CVE / severity: CVE-2026-119075 | 8.8 (High)
• Affected versions: Registration Form for WooCommerce (ThemeGrill) [7].
• Action now:
  • Update to the latest version immediately: wp plugin update registration-form-for-woocommerce.

Active Campaign Watch

WordPress Core Upgrade RCE — Massive exploit campaign (240,000+ attempts) targeting the upgrade process flaw reported previously [3].

• Impact: Unauthenticated Remote Code Execution.
• Action now: Ensure WordPress Core is at 6.7.1 or equivalent security branch. Monitor logs for unusual POST requests to /wp-admin/includes/class-wp-upgrader.php if exposed [3].