Elementor CSRF Flaw Puts WordPress Hosts on Update Alert

Patchstack says Elementor 4.3.0 and 4.3.1 allowed crafted links to bypass REST API CSRF checks, raising the risk of unwanted administrator actions on WordPress sites.

Cloudflare Fixes Containers Cross-Tenant Disk Exposure Flaw

Cloudflare says it has fixed a cross-tenant data exposure vulnerability in Cloudflare Containers and Cloudflare Sandboxes after outside researchers showed that a new workload could recover residual disk […]

WordPress Click2Shell Disclosure Puts Hosting Patch Windows in Focus

WordPress site operators have another core update to prioritize after researchers disclosed technical details and a proof-of-concept for a vulnerability dubbed Click2Shell. BleepingComputer reports that the issue is […]

Hostinger Patches LiteSpeed Zero-Day After Shared Hosting Attack

Hostinger says a LiteSpeed Web Server zero-day was used against one Brazil shared-hosting server, with LSWS 6.3.7 Build 2 deployed across its fleet the same day.

Acronis Patches Actively Exploited cPanel Backup Plugin Flaw

Acronis says limited in-the-wild exploitation has targeted its cPanel backup plugin; patched builds are available for both cPanel & WHM and Plesk integrations.

Exposed Vite Dev Servers Targeted for AWS and Azure Secrets

A new mass-scanning campaign is targeting Vite development servers that have been left reachable from the public internet, with attackers attempting to collect cloud credentials and configuration data […]

Cloudflare Starts Post-Quantum DNSSEC Validation on 1.1.1.1

Cloudflare is using its 1.1.1.1 resolver to test ML-DSA-44 DNSSEC validation at Internet scale, surfacing size and downgrade issues DNS operators will need to solve before a wider post-quantum migration.

Cloudflare Pushes Post-Quantum TLS to Origin Connections

Cloudflare Automatic Key Exchange measures origin TLS support and prefers post-quantum key exchange where available, reducing handshake retries for eligible hosted sites.

Microsoft to Block Mail From Outdated Exchange Servers

Microsoft will raise the minimum Exchange Server 2016/2019 baseline for hybrid mail into Exchange Online, creating delivery risk for unpatched servers.

Virtualizor BGP Hijack Turns Hosting Panel Updates Into Supply-Chain Risk

A reported BGP hijacking incident was used to push a malicious update to Virtualizor, a virtualization control panel used by hosting providers and VPS operators, according to BleepingComputer. […]