19 articles
Every article tagged Security, newest first. The Security category lists most of these articles too. Search all articles
Security10 min read
cPGuard supply chain attack: check your server and WordPress sites
The cPGuard supply chain attack put root-level server credentials at risk through a malicious automatic update on November 2, 2026. Check your cPGuard update history first, even if you have already patched the server.
Security11 min read
DreamHost data breach: what to check on your WordPress site now
The DreamHost data breach exposed FTP/SFTP credentials and some webmail accounts, putting affected WordPress sites at risk of unauthorized changes. Start by checking DreamHost's reset notice and securing your file-access and email accounts.
Security10 min read
Audit WordPress plugin capabilities after installing plugins
Audit WordPress plugin capabilities by recording each role before you install or update a plugin, recording it again afterward, and testing the tasks that changed.
Security12 min read
Ultra Addons for Contact Form 7 vulnerability: check, update and recover
The Ultra Addons for Contact Form 7 vulnerability (CVE-2026-102435) affects plugin versions 3.5.54 and earlier when PDF Generator is enabled and a form uses it. Version 3.5.55 fixes the flaw. Check your installed version and PDF Generator settings first, then update and look for signs of deleted files.
Security13 min read
WordPress 7.1.4 security release: exploited updater flaw and what to do now
The WordPress 7.1.4 security release fixes 22 vulnerabilities, including an updater flaw that needs no login and can lead to remote code execution. Wordfence recorded attack attempts, and on November 3, 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
Security11 min read
HTTP2Shell (CVE-2026-111497): WordPress and Next.js exposure
HTTP2Shell is CVE-2026-111497, a flaw in Google's Brotli decoder that can corrupt memory when software decompresses malicious data. Also called Node2Shell and Broccoli2Shell, it has fixes in Node.js 22.23.4, 24.22.1 and 26.12.1, plus Brotli 1.0.10, 1.1.1 and 1.2.1.
Security11 min read
PHP session upload progress vulnerability after the PHP2Shell patch
The PHP session upload progress vulnerability remains open after the PHP2Shell patch. On 23 October 2026, php.net warned about an unlikely remote code execution path tracked as CVE-2026-115560; the 21 October security releases still fix the two original PHP2Shell vulnerabilities.
Security11 min read
AI agents in US bank accounts: what banks found and what to do now
AI agents accessing bank accounts have prompted major US banks to tighten security after Axios reported on Thursday, 22 October 2026, that third-party assistants were operating inside customer accounts, sometimes beyond user instructions.
Security14 min read
PHP critical security update: PHP2Shell leak and fixes
PHP released a PHP critical security update on Wednesday, October 21, 2026, for two vulnerabilities known as PHP2Shell that allow remote code execution without authentication. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.