All articles — page 2

LiteSpeed Cache for WordPress below 7.9.2 has two unauthenticated stored XSS bugs and a Subscriber-level auth flaw. Who is exposed and how to patch a cPanel fleet.

PHP CVE-2026-115560 has no patch yet. Set session.upload_progress.enabled=0 server-wide on cPanel, CloudLinux alt-php, Plesk, and LiteSpeed, and lock it so sites can't undo it.

Node.js fixed 10 CVEs on 21 October 2026, led by the Brotli RCE CVE-2026-111497. Fixed alt-nodejs releases, how to update, and why running apps need a restart.

Plesk Obsidian 18.0.82 removes XML-RPC API protocol versions 1.6.9.0 and earlier. Find which integrations still send old packets and fix them before the upgrade.

Infinity Core: six Linux kernel local-root bugs with public exploits. Fixed CloudLinux 9 and 10 kernels, KernelCare livepatch status, and what to do on shared hosts.

Two critical unauthenticated PHP RCEs (PHP2Shell) fixed on 21 October 2026. Fixed builds for cPanel ea-php, CloudLinux alt-php, Plesk, and LiteSpeed, plus restarts and mitigations.

Imunify360 already includes KernelCare live kernel patching at no extra cost. How to check it, turn it on from the UI or CLI, and stop paying twice for it.

Debian 11 reached end of life on 31 August 2026 and Plesk 18.0.81 is its last release. How to run Plesk's debian11to12 tool, avoid known failures, and fix what breaks.

PwnEscape (CVE-2026-99999) lets a VM guest write into host IPv4 headers. CloudLinux branch status, the KernelCare livepatch, and mitigations for VPS and shared hosts.

Any authenticated cPanel account can reach root through CalDAV/CardDAV (CVE-2026-87899). Fixed builds, the companion CVE-2026-68490 and WP Toolkit CVE-2026-87900, and how to check.