Vulnerabilities
Prepare PHP Systems for October 21 Critical Security Patch Release
The PHP team will release a critical update on October 21 fixing two severe flaws rated 9.2, requiring attention from web hosting providers.
WordPress
Everything Shell Bulletin has reported about WordPress: 7 stories, newest first. Part of our Vulnerabilities coverage.
Cyber Attacks
Verify Rank Math PRO Activation Status Before Restoring Site Backups
Attackers inserted malware into specific Rank Math PRO distribution packages, granting them persistent site access and credential theft capabilities.
Vulnerabilities
Secure LatePoint Accounts Against OTP Race Condition Bypass Attack
Unauthenticated attackers can seize customer accounts in the LatePoint WordPress plugin by exploiting a timing flaw that circumvents login lockout protections.
Vulnerabilities
Secure WordPress Sites Against Unauthenticated Admin Takeover in My Calendar
A critical flaw in the My Calendar plugin allows attackers to hijack administrator accounts without credentials, granting full control over affected WordPress sites.
Vulnerabilities
Review Mang Board WP Plugin Exposure Before Version 2.4.4 Update
A critical SQL injection flaw in the Mang Board WP plugin exposes sites running version 2.4.4 or earlier to potential database manipulation by attackers.
Vulnerabilities
Automattic investors face fresh uncertainty as interim CFO Klaperman exits weeks after boardroom shakeup
The interim chief financial officer left the WordPress parent company weeks after a boardroom shakeup, signaling ongoing leadership instability.
Vulnerabilities
Urgent: Patch PPOM WooCommerce Plugin to Block Unauthenticated RCE and File Deletion Attack
Unauthenticated attackers can delete server files and execute code via a critical path traversal bug in the PPOM WooCommerce plugin versions up to 34.0.10.