Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. WordPress / CMS: Active Core & Plugin Exploitation

Active Exploitation: WordPress Core Update-Window RCE — CISA has confirmed active exploitation of a race condition in the WordPress update process that allows unauthenticated remote code execution during the upgrade window [2][3]. Attackers are actively probing for sites in the process of updating [3].

• CVE / severity: No CVE assigned (listed as WordPress Core weakness) / Critical
• Affected versions: WordPress Core 4.7 through 7.1.3 [3]
• Fixed in: WordPress 7.1.4 (released previously; exploitation is current for unpatched sites)
• Action now:
  • Force update to WordPress 7.1.4 immediately via wp core update.
  • Monitor access logs for unusual POST requests to wp-admin/includes/class-wp-upgrader.php or async-upload.php during update cycles.

LiteSpeed Cache Sensitive Information Disclosure — A new vulnerability in the LiteSpeed Cache plugin allows unauthenticated attackers to leak sensitive WooCommerce data [4].

• CVE / severity: CVE-2026-93389 / High
• Affected versions: All versions prior to 6.5.3 (approximate based on current disclosure)
• Fixed in: Not disclosed in sources; check for latest plugin updates via wp plugin update litespeed-cache [4].
• Action now: Update to the latest version immediately; if no update is available, consider disabling the WooCommerce-specific caching features.

Security For WooCommerce Privilege Escalation — A flaw in capability checks allows unauthenticated users to create accounts with unauthorized privileges [5][6].

• CVE / severity: CVE-2026-100109 / 8.8 (High)
• Affected versions: 1.0.10 to 1.0.16 [5]
• Fixed in: Not disclosed in sources [6]
• Action now: Audit all user accounts created in the last 48 hours; deactivate plugin until a patch is confirmed.

2. Infrastructure: Supply Chain & Hosting Compromises

cPGuard / OPSSHIELD Update Channel Compromise — Attackers breached the billing and licensing systems of OPSSHIELD on Nov 3, 2026, stealing the update-signing key. This was used to push a malicious update ("fake patch") to servers running cPGuard, effectively creating a supply-chain backdoor for hosting providers [7].

• CVE / severity: No CVE assigned / Critical (Supply Chain)
• Affected versions: cPGuard installations receiving updates on or after Nov 3, 2026 [7]
• Fixed in: OPSSHIELD has revoked the compromised key; manual remediation may be required [7].
• Action now:
  • Check for unauthorized binary changes in /usr/local/cpguard.
  • Rotate all server root credentials and API tokens if the malicious update was pulled.
  • Verify the current cPGuard version against official OPSSHIELD clean-build checksums.

DreamHost File Manager Breach — A long-term covert compromise (August – Oct 23, 2026) was disclosed involving an unpatched flaw in DreamHost’s browser-based File Manager. This allowed attackers to escape the tool and access underlying server environments, exposing customer files and inboxes [10].

• CVE / severity: Not disclosed / High
• Affected versions: DreamHost browser-based File Manager [10]
• Fixed in: Patched as of October 23, 2026 [10]
• Action now:
  • DreamHost customers should rotate all FTP/SFTP, database, and SSH credentials.
  • Audit mail logs for unauthorized forwarding rules or unusual IMAP/POP3 logins.

3. Server Hardening & Global Trends

Weaponization Speed: "35-Minute Window" — New research indicates that 90% of vulnerabilities with public Proof-of-Concept (PoC) code are weaponized within days or even minutes. Attackers are currently automating the transition from public research to active exploits in as little as 35 minutes [14]. Infrastructure teams should prioritize automated patching or virtual patching via WAF/IPS to mitigate this rapid exploitation cycle.

cPanel/WHM Authentication Hardening — Per recent documentation updates, cPanel has disabled HTTP Basic authentication by default for ports 2082/2083 to mitigate credential theft and bypass risks [12].

• Action now: Migration to API tokens for all scripted integrations is required. Ensure skiphttpauth=1 is set in cpanel.config unless legacy support is strictly necessary [12].