Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. CRITICAL INFRASTRUCTURE & HOSTING PANEL UPDATES

Blesta Billing & Automation Multiple Vulnerabilities — Critical security issues identified in the core hosting billing platform, impacting integration with cPanel, WHM, and Plesk environments [13].

• CVE / severity: Not disclosed in source (Multiple issues) / High
• Affected versions: Blesta 6.0.0 through 6.0.2
• Fixed in: Blesta 6.0.3
• Action now:
  • Manually update to version 6.0.3 via the Blesta admin dashboard or CLI.
  • Audit server logs for unauthorized access to billing data or panel integrations.

cPanel & WHM "ngCERT" Critical Vulnerability Alert — New national-level advisory regarding a critical flaw that allows potential full system compromise [14].

• CVE / severity: Not disclosed in source / CVSS 9.8 (Critical)
• Affected versions: All supported versions of cPanel & WHM
• Fixed in: Patched versions available (specific version numbers not in source)
• Action now:
  • Run /scripts/upcp immediately on all cPanel nodes.
  • Verify that the installation is running the latest STABLE or RELEASE tier build.

2. WORDPRESS CORE & PLUGIN EXPLOITATION

WordPress 7.1.2 Core Flaw Active Exploitation — Rapid weaponization of the latest core patch; host-level hardening is the primary defense against RCE attempts [3].

• CVE / severity: CVE-2026-87902 / High
• Affected versions: WordPress Core < 7.1.2
• Fixed in: WordPress 7.1.2
• Action now:
  • Force update core via wp core update.
  • Implement host-level WAF rules to block unusual POST requests to core files.

User Frontend Unauthorized Account Creation — Plugin fails to respect WordPress site registration settings, allowing arbitrary account creation [8].

• CVE / severity: CVE-2026-75824 / Medium-High
• Affected versions: User Frontend < 4.3.12
• Fixed in: User Frontend 4.3.12
• Action now:
  • wp plugin update wp-user-frontend
  • Audit the wp_users table for accounts created via the frontend without authorization.

EmbedPress Cross-Site Scripting (XSS) — A vulnerability in the EmbedPress plugin allows for script injection through malicious embeds [1].

• CVE / severity: CVE-2026-85001 / Medium
• Affected versions: All versions up to and including latest reported
• Fixed in: Not disclosed in source; check for version updates > 4.x
• Action now:
  • Temporarily disable the plugin if no update is available or restrict contributor-level access to the editor.

3. EMERGING THREATS & HOSTING DEFENSE

AI-Driven Zero-Day Exploitation — Monitoring indicates AI agents are identifying and exploiting vulnerabilities approximately 8 hours before public disclosure, significantly narrowing the patch window for hosting providers [12].

• Impact: Hosting providers report difficulty distinguishing normal customer traffic from AI-led automated probes.
• Action now:
  • Deploy behavioral rate-limiting at the firewall/edge level.
  • Transition from reactive patching to proactive "Virtual Patching" via WAF for newly identified CVE patterns.

WP Popular Posts Information Disclosure — Sensitive data exposure in post parameters could facilitate more targeted attacks [2].

• CVE / severity: No CVE assigned / Medium
• Affected versions: WP Popular Posts <= 7.4.2
• Fixed in: Not disclosed in source
• Action now:
  • Monitor context and post_type parameters in logs for information gathering signatures.