Two decades
inside the web
as it kept rewriting
itself.

Critical WordPress Core & Plugin Vulnerabilities

• WordPress Core RCE: A critical unauthenticated remote code execution (RCE) vulnerability (CVE-2026-63030) has been disclosed, posing a high risk to all unpatched installations [3]. A separate critical attack chain involving CVE-2026-60137 has also been identified [5].
• Kirki Plugin Exploits: Two major flaws affect the Kirki Freeform Page Builder. CVE-2026-8206 (CVSS 9.8) allows full admin takeover via a broken password reset mechanism [1]. CVE-2026-15601 enables authenticated Zip Slip file writes [2].
• Fancy Product Designer Zero-Day: A zero-day vulnerability in the Fancy Product Designer plugin is currently undergoing active exploitation in the wild [4].

Hosting Infrastructure & Management Threats

• cPanel Zero-Day: Hackers are actively exploiting a flaw in cPanel, the industry-standard management interface. Providers including Namecheap and KnownHost have implemented emergency blocks and patches to mitigate unauthorized access attempts [10].
• Hostinger Breach: A major security incident at Hostinger has impacted approximately 14 million customers after an unauthorized party accessed internal systems [7].
• DDoS & VPS Compromise: Australian provider VentraIP was targeted by a significant DDoS attack [9]. Additionally, reports of VPS-level hacks leading to Google "Deceptive Site Ahead" warnings emphasize the need for IP-based access controls [8].

Active Malware & Persistence Trends

• Obfuscated Backdoors: Attackers are increasingly deploying malware disguised as legitimate plugins to maintain persistence. These backdoors include sophisticated file management capabilities to evade detection [6].
• Recovery Guidance: Infrastructure teams are advised to prioritize restoration from known-good backups and implement strict Host Access Control settings to restrict management interface access [6], [8].