Security alerts
What to fix right now.
Short alerts when a serious flaw hits sites like yours: what happened, who is affected, how to check your site and what to do. The important ones from the past year are here too, in case you missed them. Every alert cites its official sources.
Security alerts
December 2025
n8n: actively exploited code execution flaw, update self-hosted instances
A critical n8n flaw (CVE-2025-68613) lets a logged-in user run commands on the server. It is exploited in the wild.
Roundcube webmail flaw exploited through SVG images: check your webmail version
A Roundcube flaw fixed in December 2025 was later confirmed exploited. Many hosts use Roundcube as webmail. Check that yours is current.
React2Shell: critical flaw in React and Next.js, update and rotate secrets
Exploited in the wild since December 2025, CVE-2025-55182 lets anyone run code on servers using React Server Components.
October 2025
Post SMTP plugin flaw exploited to take over admin accounts: update to 3.6.1 or later
Post SMTP let anyone read the site's email logs, including password reset emails, and take over an administrator account.