Security alerts
What to fix right now.
Short alerts when a serious flaw hits sites like yours: what happened, who is affected, how to check your site and what to do. The important ones from the past year are here too, in case you missed them. Every alert cites its official sources.
Security alerts
October 2026
PHP2Shell: two critical PHP flaws under attack, update now
Two flaws in PHP let attackers take over a server without logging in. Fixed on 21 October 2026. Who is affected, how to check, what to do.
UpdraftCentral keys stolen to plant malicious plugins: update UpdraftPlus and check
Stolen UpdraftCentral keys were used to add admin accounts and malicious plugins to connected WordPress sites.
Some Rank Math SEO PRO 3.0.123 downloads contained malware: check and install 3.0.124
Copies of Rank Math SEO PRO 3.0.123 downloaded on October 15 and 16, 2026 carried malware. The free plugin is not affected.
Next.js: critical flaws fixed in 2026, update to 15.5.28 or 16.4.1
Next.js security releases since August 2026 fix several flaws that allow remote code execution without logging in.
September 2026
WordPress core file inclusion flaw exploited: make sure you run 7.1.2 or a patched branch
A WordPress core flaw lets anyone without an account load files from the server, and on some setups run code.
Ninja Forms and WPC Product Bundles flaws used to hide admin accounts: update and check
Attackers used flaws in Ninja Forms and WPC Product Bundles to plant code that creates hidden administrator accounts.
Magento and Adobe Commerce zero-day used to take over shops: patch and rotate keys
An exploited Magento flaw let attackers run code on online shops without logging in. Adobe asks merchants to patch and rotate credentials.
August 2026
Elementor Pro form upload flaw exploited: update to 4.2.2 or later
A flaw in Elementor Pro forms let anyone upload a malicious file and take over the site. Attacks began on the day of the fix.
Shai-Hulud worm hits keyv and cache packages on npm: check and rotate keys
In August 2026, over 1,300 npm package versions, including keyv, were poisoned by a worm that steals developer credentials.
July 2026
WordPress core wp2shell flaws exploited: confirm you run 7.0.2, 6.9.5 or 6.8.6
Two WordPress core flaws let anyone take over a site without logging in. Attacks began the day of the fix.
June 2026
JCE editor for Joomla let anyone upload code: update and check for intrusions
A critical flaw in JCE, a popular Joomla editor, was exploited to plant scripts on sites without logging in. Update and look for traces.
May 2026
LiteSpeed cPanel plugin flaws gave hosting accounts root access: ask your host
Two exploited flaws in LiteSpeed's cPanel plugin let a hosting account take over the whole server. Check that your host updated in mid 2026.
Exim mail server flaw allowed remote code execution without login: update Exim
A critical Exim flaw could let anyone who connects to the mail server run code on it. Fixed in May 2026, followed by more Exim fixes.
April 2026
cPanel and WHM login bypass used in ransomware attacks: confirm your server is patched
A critical cPanel & WHM flaw let attackers into control panels without a password. It was mass exploited. Check that your host patched.
March 2026
Malicious axios versions on npm: check your projects and rotate keys
On March 31, 2026, axios 1.14.1 and 0.30.4 were published with malware. Machines that installed them are compromised.
January 2026
n8n Ni8mare: critical flaw reachable without login, update self-hosted n8n
CVE-2026-21858, rated 10 out of 10, lets an attacker read server files through n8n forms without logging in.