Security news
One briefing a week for the people who keep WordPress sites and the servers under them running. Each issue covers what is being exploited, what was patched, which versions close it, what to search your logs and file systems for, and a short list of actions in priority order. Core and plugins are covered alongside the hosting stack — cPanel and WHM, CloudLinux, PHP, Imunify — because that is where a site compromise turns into a server one.
Weekly briefings
Weekly briefing · 5 October 2026
CVE-2026-87902 is now exploited through pearcmd.php, cPanel fixed a root flaw, and six plugins need urgent updates. What changed this week and what to do.
Read this briefingHow each briefing is written
A flaw that is being used in real attacks comes before a flaw that is merely severe. Each item says which it is, and on what evidence.
Every vulnerable range and fixed version is given exactly, so you can compare it against what is installed rather than guess from a headline.
Updating closes the door; it does not remove anyone already inside. Where a flaw has been exploited, the briefing lists what to search your logs and file systems for.
cPanel, WHM, CloudLinux, PHP and Imunify fixes are covered because a compromised hosting account is where a site incident becomes a server incident.
Every claim links to the vendor advisory, database entry, or research that published it. Where sources disagree, or only one source exists, the briefing says so.
Briefings are compiled from published sources. Nothing in them is drawn from client incidents in a way that could identify anyone.
Related reading