Category
Hardening a VPS: SSH keys, firewalls, private networking and access control, plus alerts when PHP, WordPress or a dependency has a hole to patch.
16 articles
Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619) allow remote code execution and are being exploited. Here is how to check your server, pa…
Docker writes its own firewall rules, so UFW can say a port is blocked while a container port stays open to the internet. Here is how to check your ow…
CVE-2026-87902 is a critical WordPress core RCE flaw, no plugin needed, affecting every version from 4.7 through 7.1.1. Here's how it works, why Docke…
Two critical, unauthenticated CVEs (CVSS 9.8) hit The Events Calendar plugin a day apart, putting 600,000+ WordPress sites at risk. Here's what each a…
Composer added real malware protection this year through composer audit and Packagist's new scanning, but a recent attack hid malicious code in packag…
2026 has had a steady run of npm supply chain attacks hitting packages with hundreds of millions of weekly downloads. If your build pipeline runs npm…
CVE-2026-8457 let attackers log in as any admin on WooCommerce sites using Apple login, with no password needed. Here is what happened, how to check i…
CVE-2026-32475 is a critical, unauthenticated file upload flaw in Elementor Pro up to 4.2.1, fixed in 4.2.2. Here is how to check your version, why an…
A critical vulnerability in the All-in-One WP Migration and Backup plugin, used on over 5 million sites, lets an attacker achieve remote code executio…
A Composer bug leaked GitHub Actions tokens straight into CI logs when it encountered GitHub's new token format. Here's how to check if you were affec…
Too many certificates already issued for exact set of domains means you hit Let's Encrypt's 5-per-week duplicate limit. Here is why shorter certificat…
Let's Encrypt is shortening its certificate lifetimes, moving from 90 days down to 64 days by February 2027, with 45-day and even 6-day options alread…
Page 1 of 2 · 16 articles
