Jason Nickerson — Hosting Industry InsiderTwo decades
inside the web
as it kept rewriting
itself.

1. Infrastructure & Hosting Control Panels

cPanel & WHM Critical Auth Bypass — A zero-day vulnerability is being actively exploited against an estimated 1.5 million servers. Evidence suggests the flaw was used in the wild for 64 days prior to public disclosure [6]. Remediation scripts are circulating to address both this and a concurrent Linux kernel vulnerability [9].

• CVE / severity: CVE-2026-41940 | CVSS 9.8 (Critical)
• Affected versions: cPanel & WHM versions prior to 118.0.21 (exact range not disclosed in sources)
• Fixed in: 118.0.21 or later
• Action now:
  • Run /scripts/upcp to force an immediate update to a secure tier.
  • Execute security remediation scripts to audit for unauthorized proxy/domain configurations [9].
  • Audit logs for unusual authentication patterns originating from internal service bypasses.

Check Point Management Interface Path Traversal — A pre-authentication flaw allows unauthenticated attackers to traverse directories and potentially upload malicious files to the Management web service [7].

• CVE / severity: CVE-2026-93616 | Severity not disclosed
• Affected versions: Check Point Management web service (versions not specified in sources)
• Fixed in: Contact vendor for latest security hotfix [7].
• Action now:
  • Restrict access to the Management web service to trusted internal IPs only.
  • Monitor for unauthorized file uploads in web service directories.

Kiteworks Imminent Threat Warning — The vendor has issued a critical advisory urging customers to shut down servers immediately due to an "imminent threat" of targeted cyberattacks [8].

• CVE / severity: No CVE assigned (targeted threat)
• Affected versions: All Kiteworks managed file transfer servers
• Fixed in: N/A (ongoing incident)
• Action now:
  • Power down Kiteworks instances until further vendor guidance is issued [8].

2. WordPress Core & Plugin Exploitation

WordPress Core Remote Code Execution (RCE) — Massive exploitation of CVE-2026-87902 is underway. Attackers used the September 22 patch as a blueprint to develop exploits within hours, successfully deploying PHP webshells on over 350,000 sites [1], [3], [4].

• CVE / severity: CVE-2026-87902 | Critical
• Affected versions: WordPress Core 7.1.0 and 7.1.1 [11]
• Fixed in: WordPress 7.1.2
• Action now:
  • Update to WordPress 7.1.2 immediately via wp core update.
  • Scan for unauthorized PHP files (webshells) in wp-content/uploads and core directories [4].

Elementor Website Builder CSRF Protection Bypass — A specific logic flaw in Elementor's REST API handling disables global WordPress CSRF protections if a specific string is present in the URI, affecting over 2 million sites [11], [13].

• CVE / severity: No CVE assigned | Medium/High
• Affected versions: Elementor 4.3.0 and 4.3.1
• Fixed in: 4.3.2 (or latest stable)
• Action now:
  • Update plugin via wp plugin update elementor.

3. Linux & Server-Side Vulnerabilities

Linux Kernel "Copy Fail" Privilege Escalation — A kernel-level flaw is being targeted alongside hosting panel exploits to gain elevated permissions [9].

• CVE / severity: CVE-2026-31431 | High
• Affected versions: Linux Kernel (versions not disclosed in sources)
• Fixed in: Latest stable kernel distributions
• Action now:
  • Perform a system-wide update: dnf update or apt upgrade and reboot to apply new kernel headers [9].