Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

CORE INFRASTRUCTURE & HOSTING ALERTS

cPanel & WHM Authentication Bypass & Active Exploitation — A critical flaw allowing unauthenticated attackers to gain full administrative control is being actively exploited by ransomware groups [14]. Additionally, CISA has added an Acronis Backup plugin privilege escalation flaw to its KEV catalog following widespread exploitation [13].

• CVE / severity: CVE-2026-41940 (Score not disclosed, Critical); CVE-2026-87886 (Local Privilege Escalation) [13, 14].
• Affected versions: cPanel & WHM (specific versions not disclosed); Acronis Backup plugin for cPanel/WHM and Plesk [12, 13].
• Fixed in: /scripts/upcp (ensure latest stable build); Acronis has issued patches for affected plugins [12].
• Action now: Run /usr/local/cpanel/scripts/upcp immediately; update all Acronis plugins via the cPanel/Plesk interface; rotate all administrative credentials if exploitation is suspected [12, 14].

Brevo Supply Chain Attack (ClickFix Malware) — A compromise of the Brevo (formerly Sendinblue) marketing platform enabled attackers to inject malicious ClickFix-style overlays on over 100,000 websites, attempting to trick users into downloading malware [10, 11].

• CVE / severity: No CVE assigned (Supply Chain Compromise).
• Affected versions: Sites utilizing Brevo JS snippets or integrations [10].
• Fixed in: Infrastructure hardening by Brevo; malicious scripts have reportedly been neutralized [10].
• Action now: Verify the integrity of any third-party JS snippets; check site logs for unusual outgoing connections to known ClickFix domains; clear site-level caches [11].

WORDPRESS CMS & PLUGIN THREATS

WordPress 7.1.1 Critical Security Release — A mandatory security update has been released to address 11 vulnerabilities in the WordPress core. Infrastructure teams should prioritize automated updates [3].

• CVE / severity: 11 undisclosed CVEs (High/Critical) [3].
• Affected versions: WordPress Core 7.1.0 and prior [3].
• Fixed in: WordPress 7.1.1 [3].
• Action now: Update via WP-CLI: wp core update. Ensure all managed sites are running the latest security patch immediately [3].

Tutor LMS PHP Object Injection — A critical vulnerability in the Tutor LMS plugin (100,000+ installs) allows subscriber-level users to achieve Remote Code Execution (RCE) via PHP Object Injection [2].

• CVE / severity: CVE-2026-27540 (Score not disclosed, RCE impact) [6].
• Affected versions: Tutor LMS through 2.0.3.1 [6].
• Fixed in: Not disclosed in sources (refer to latest plugin version) [2].
• Action now: Update the Tutor LMS plugin immediately via wp plugin update tutor; review subscriber-level account activity for unauthorized changes [2, 6].

The Events Calendar RCE — Two critical flaws allow unauthenticated attackers to execute code remotely on sites running this widely used plugin [1].

• CVE / severity: Not disclosed in sources (Critical RCE) [1].
• Affected versions: Not disclosed in sources [1].
• Fixed in: Refer to latest plugin repository for emergency patches [1].
• Action now: Update the plugin immediately; if updates are not possible, consider temporarily disabling the plugin or blocking POST requests to event endpoints at the WAF level [1].

DDOS & NETWORK DEFENSE

NightmareStresser Takedown — Federal authorities have seized domains associated with NightmareStresser, a major DDoS-for-hire platform responsible for hundreds of thousands of attacks against hosting providers and infrastructure [9]. While the service is down, hosting providers should remain vigilant for retaliatory spikes from alternative "stresser" services [9].