News
NewsWordfence: 655 WordPress vulnerabilities in one week, themes under attack
The Wordfence report for 5–11 October 2026 marks a peak: 655 vulnerabilities, 100 themes affected compared to just 9 the previous week.
NewsNGINX Ingress Controller 5.7: HTTP/2 to backends and Opaque Secrets
NGINX Ingress Controller version 5.7.0 brings HTTP/2 upstream support, Opaque Secrets, and cert-manager ACME challenges behind HTTPS redirects to Kubernetes.
NewsCVE-2026-99999 "PwnEscape": critical kernel flaw for VM-to-host escape
CVSS 9.3 flaw in the Linux kernel allows a guest VM to corrupt host memory. CloudLinux: no patched kernel available yet as of 16 October.
NewsCloudflare introduces continuous trust score for Verified Bots
Declaring who you are is no longer enough: Cloudflare measures over time whether verified bots respect robots.txt and 429 status codes. Data coming to Radar.
NewsWooCommerce Wholesale Lead Capture: webshells uploaded seven months post-patch
CVE-2026-27540, CVSS 9.8: WooCommerce plugin exploited to upload PHP webshells seven months after patch. How to verify if your site is compromised.
NewsCloudflare: five interventions in five years to slow data infrastructure growth
Cloudflare explains how it cut data pipeline traffic without increasing hardware: schema partitioning, compression, replication, sampling and aggregations.
NewsCloudflare explains how D1 handles millions of databases without query slowdown
Cloudflare details D1's control plane architecture: one SQLite Durable Object per database, Hyperdrive and Workers KV to avoid bottlenecks.
NewsUSN-8923-1: two use-after-free flaws in Ubuntu 14.04 and 16.04 kernel
Canonical patches two use-after-free vulnerabilities in SCSI and Bluetooth on Ubuntu 14.04 and 16.04: update only via Ubuntu Pro Legacy add-on, reboot required.
NewsUSN-8920-1: Linux kernel flaws in AWS, Azure and IBM on Ubuntu
Canonical fixes a dozen CVEs in the cloud kernel on Ubuntu 18.04 and 20.04: reboot required and patches available only with Ubuntu Pro.
NewsUSN-8918-1: Azure kernel patch for Ubuntu 24.04, reboot and module rebuilds required
Ubuntu fixes dozens of vulnerabilities in the linux-azure kernel for 24.04 LTS. ABI change: third-party kernel modules must be recompiled. Package and version details included.
NewsUSN-8924-1: nine kernel flaws in Ubuntu 14.04, patches only with Ubuntu Pro
Canonical releases nine fixes for the Ubuntu 14.04 LTS kernel. The version has been out of standard support since 2019: the patch arrives only with the Legacy add-on to Ubuntu Pro.
NewsCVE-2026-19949: SQL injection flaw in All-in-One WP Migration, 3.2m sites still at risk
Second-order SQL injection vulnerability in All-in-One WP Migration and Backup (CVSS 8.8). Patched in 7.110, but 3.2 million sites remain unpatched.
NewsLet's Encrypt certificates at 45 days: reconfigure renewal before expiry
Let's Encrypt is shortening certificate lifetimes: from an opt-in 45-day profile to a 64-day default in 2027. What to change in certbot, acme.sh and lego.
NewsUSN-8915-1: Eight FFmpeg flaws, one with arbitrary code execution risk
Ubuntu patches eight vulnerabilities in FFmpeg across all active LTS releases. One, CVSS 8.8, enables code execution via crafted files.
NewsGhostscript critical flaw CVE-2026-39919: RCE from PDF upload on WordPress
Wordfence Argus discovers critical buffer overflow (CVSS 9.8) in Ghostscript, used by WordPress for PDF thumbnails. Patched in 10.08.0.
NewsDocker Hub CVE-2026-105445: personal tokens leaked to org owner
From 26 August 2024 to 30 September 2026, converting an account to an organisation on Docker Hub reassigned personal tokens. Fix applied, users notified.
NewsUSN-8914-1: critical flaw in Google Guest Agent on Ubuntu 22.04, patch available
Ubuntu patches a vulnerability in Google GCE packages that allowed hostname-based access controls to be bypassed. CVE-2026-39821, CVSS 9.6.
NewsCloudflare Logpush: SQL Transformers now GA, pay-per-use pricing from $0.04/GB
Logpush now available on all self-serve plans and SQL Transformers are generally available: filter, redact and reshape logs before export.
NewsUSN-8913-1: four libx11 flaws patched across all Ubuntu LTS releases
Canonical fixes four CVEs in libx11 across all active Ubuntu LTS releases from 14.04 to 26.04. One flaw potentially allows arbitrary code execution from a malicious X server.
NewsWordPress Updates and Vulnerabilities This Week: GiveWP, Pods and WooCommerce Under Attack
Four critical CVEs in widely-deployed WordPress plugins released in recent weeks: GiveWP, Pods, WooCommerce Wholesale Lead Capture and Ajax Search Lite. Affected versions and wp-cli commands.