{"id":7036472,"date":"2026-08-10T09:53:27","date_gmt":"2026-08-10T09:53:27","guid":{"rendered":"https:\/\/peraltafinancing.com\/business\/internet-business\/weekly-cybersecurity-summary-31-july-to-6-august-2026\/"},"modified":"2026-08-10T09:53:27","modified_gmt":"2026-08-10T09:53:27","slug":"weekly-cybersecurity-summary-31-july-to-6-august-2026","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=7036472","title":{"rendered":"Weekly Cybersecurity Summary \u2014 31 July to 6 August 2026"},"content":{"rendered":"


\n<\/p>\n

\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n
\n

The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This week we’re covering five issues: two critical privilege escalations affecting cPanel & WHM (including its bundled Exim mail server and the ConfigServer firewall it now distributes), two WordPress plugin vulnerabilities that could lead to full site takeover, and a pair of Linux kernel local-root flaws affecting shared and VPS hosting platforms.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

[Critical] cPanel & WHM August Security Release (CVE-2026-58048, CVE-2026-58047, GCVE-25-2026-07-45-3)<\/h3>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
\n

cPanel & WebPros published a coordinated security release on 4 August 2026 covering three separate issues found in cPanel & WHM and its bundled Exim mail transfer agent. The most serious, CVE-2026-58048, is a privilege escalation in the database management system: when a database is renamed, cPanel does not preserve the connection’s SQL mode, which allows SQL statements to execute in a root database context instead of the account holder’s own. Anyone with a cPanel account and access to the MySQL or MariaDB feature could use this to run database commands with full administrative privileges. The same release fixes CVE-2026-58047, an HTTP request-smuggling flaw in cpsrvd that, under limited conditions, can leak the credentials of other account holders on a shared server, and a separate local privilege escalation in Exim’s .forward pipe-transport handling that lets a Team User sub-account escalate to the primary cPanel account.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Affected: <\/strong><\/h4>\n

All supported versions of cPanel & WHM prior to the August 2026 builds, and WP Squared. The Exim issue affects sites using cPanel’s default mail stack with pipe-transport forwarding enabled.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Fixed version: <\/strong><\/h4>\n

WHM 11.110.0.137, 11.118.0.71, 11.126.0.78, 11.134.0.48, 11.136.0.32; WP Squared 138.1.6; Exim 4.99.5.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

CVSS: <\/strong><\/h4>\n

9.4 (CVE-2026-58048, database privilege escalation); 5.6 (CVE-2026-58047, request smuggling); not yet scored (Exim local privilege escalation).<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

What this means for you:<\/h3>\n<\/div>\n
\n
\n

On shared hosting, this is patched at the platform level, so most website owners don’t need to take any action themselves. On a self-managed VPS or dedicated server running cPanel & WHM, the update needs applying directly, and administrators should check whether cpsrvd_keepalives_disabled=1 is set as an interim workaround for the request-smuggling issue if an immediate update isn’t possible.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

Recommended action:<\/h3>\n<\/div>\n
\n
\n

Update WHM to the builds listed above as soon as possible; verify Exim is running 4.99.5 or later on any self-managed server.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

[Critical] cPanel CSF (ConfigServer Security & Firewall) Root Access Vulnerabilities<\/h3>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
\n

cPanel published a further advisory on 5 August 2026, separate from the release above, covering multiple vulnerabilities in ConfigServer Security & Firewall (CSF), the firewall and login\/intrusion detection package installed on the large majority of cPanel & WHM servers. CSF is now maintained as cPanel’s own fork following the original developer’s shutdown in 2025, so this falls under the same cPanel security channel as the database and Exim issues above. cPanel’s advisory is brief: it states only that the flaws “could allow an attacker to gain root access,” without publishing a CVE identifier, a CVSS score, or detail on whether exploitation requires local access or can be triggered remotely. Because CSF runs with root privileges to manage firewall rules and monitor logs, any flaw that lets attacker-influenced input reach it is significant regardless of the missing detail.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Affected: <\/strong><\/h4>\n

CSF 16.20-1 and earlier, on any cPanel & WHM server running the ConfigServer firewall.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Fixed version: <\/strong><\/h4>\n

CSF 16.30-1. Update by running dnf clean metadata followed by \/scripts\/update-packages.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

CVSS: <\/strong><\/h4>\n

Not yet assigned. No CVE identifier had been published at the time of writing; this is a single-source advisory pending further technical detail.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

What This Means For You:<\/h3>\n<\/div>\n
\n
\n

On shared hosting, this is a platform-level fix applied by us rather than something website owners need to act on. On a self-managed VPS or dedicated server running cPanel & WHM with CSF installed, treat this as a priority update given the stated root-access impact, even though the exploitation path hasn’t been detailed publicly yet.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

Recommended Action:<\/h3>\n<\/div>\n
\n
\n

Update CSF to 16.30-1 or later on all cPanel & WHM servers as soon as possible; there is no alternative mitigation published.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

[High] WordPress Plugin: POUCO Import Users Unauthenticated Admin Takeover (CVE-2026-16256)<\/h3>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
\n

Researchers disclosed on 2 August 2026 that the POUCO Import Users plugin for WordPress performs no capability or nonce checks on the AJAX actions it exposes for creating and updating WordPress accounts. Because the plugin also trusts a role value supplied directly by the requester, an unauthenticated attacker can call the account-creation endpoint and simply specify “administrator” as the role, creating a fully privileged account without ever logging in. One vulnerability tracker classified this as an “Info” severity issue with a CVSS score of 0, which understates the real-world risk considerably: in practice this is a straightforward path to complete site takeover.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Affected: <\/strong><\/h4>\n

POUCO Import Users plugin, all versions up to and including 1.0.0.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Fixed version: <\/strong><\/h4>\n

No patched release had been published at the time of writing; sites running the plugin should deactivate it until a fix is confirmed available.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

CVSS: <\/strong><\/h4>\n

Logged as 0 (Info) by one tracker; real-world impact is consistent with a critical, unauthenticated full site takeover.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

What This Means For You:<\/h3>\n<\/div>\n
\n
\n

On shared hosting, check whether any of your sites have this plugin active and deactivate it as a precaution. On a VPS or dedicated server where you manage WordPress yourself, the same applies, and it’s worth checking the WordPress admin user list for any accounts you don’t recognise.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

Recommended Action:<\/h3>\n<\/div>\n
\n
\n

Deactivate and remove the POUCO Import Users plugin until an official fix is released; audit administrator accounts for unfamiliar entries.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

[High] WordPress Plugin: NEX-Forms Ultimate Form Builder Lite Arbitrary File Deletion (CVE-2026-15450)<\/h3>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
\n

Disclosed on 2 August 2026, this vulnerability sits in the NEX-Forms \u2013 Ultimate Form Builder Lite plugin’s delete_file() AJAX handler, which reads a file path from the database and passes it straight to PHP’s unlink() function without validating it against the real site path, a safe filename check, or an allow-list. A separate handler, insert_record(), lets an authenticated user store an arbitrary value in the database column the delete handler later trusts. Combined, this lets an attacker with admin-level access delete arbitrary files on the server, including wp-config.php, which can be used to force the site into a broken or reinstallable state.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Affected: <\/strong><\/h4>\n

NEX-Forms \u2013 Ultimate Form Builder Lite, versions up to and including 9.2.3.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Fixed version: <\/strong><\/h4>\n

A patched release beyond 9.2.3 is available; update via the WordPress plugin repository.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

CVSS: <\/strong><\/h4>\n

8.1 (High), authenticated, admin-level access required.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

What This Means For You:<\/h3>\n<\/div>\n
\n
\n

Exploitation requires an admin-level account already, so this is primarily a risk where an attacker has already compromised a lower-privilege account or is an insider. Shared hosting website owners should update the plugin at the next opportunity; VPS and dedicated server administrators managing multiple WordPress installs should check all of them for the plugin.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

Recommended Action:<\/h3>\n<\/div>\n
\n
\n

Update NEX-Forms to the latest version beyond 9.2.3 on all affected sites.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

[High] Linux Kernel Local-Root Vulnerabilities: OVSwrap and net\/sched Use-After-Free (CVE-2026-64531, CVE-2026-53264)<\/h3>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
\n

Two unrelated Linux kernel local privilege escalation bugs came to wider attention this week. OVSwrap (CVE-2026-64531), disclosed on 28 July 2026 by researcher Asim Viladi Oglu Manizada, is a length-field wraparound in how the Open vSwitch kernel datapath converts userspace flow actions into internal Netlink attributes; an unprivileged local user who can create a user and network namespace can corrupt kernel memory and gain root, with no administrator interaction required. Separately, CVE-2026-53264 is a use-after-free race in the kernel’s network traffic-control code (net\/sched\/act_api.c), where an action can be looked up and its reference count raised under RCU read protection while a concurrent delete path frees the same object without waiting for the RCU grace period. This bug was patched upstream back in June, but gained fresh urgency on 28 July 2026 when STAR Labs published a working, AI-assisted root exploit against CentOS Stream 9.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Affected: <\/strong><\/h4>\n

OVSwrap affects default configurations of AlmaLinux, CentOS Stream, Debian 12\/13, Rocky Linux, and Ubuntu 22.04\/24.04. The net\/sched flaw affects the same kernel family and is present on any unpatched build with unprivileged user namespaces enabled.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

Fixed version: <\/strong><\/h4>\n

OVSwrap: kernel 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40 or 7.1.5 and later. net\/sched: kernel 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.94, 6.18.36, 7.0.13 and later (fixed upstream since 1 June 2026).<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n

\n
\n
\n
\n
\n
<\/div>\n
\n
<\/i><\/p>\n

CVSS: <\/strong><\/h4>\n

7.8 (High) for both \u2014 local attack vector, low complexity, low privileges required, no user interaction.<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

What This Means For You:<\/h3>\n<\/div>\n
\n
\n

Both flaws require local access, so the direct risk to website owners on well-isolated shared hosting is limited. The more significant exposure is on VPS and dedicated servers, particularly where multiple untrusted users or containers share a kernel: an attacker who gains any foothold, even a low-privilege one, can use either bug to reach root. For the net\/sched bug specifically, check you’re already on a patched kernel rather than treating it as a brand-new vulnerability, since the underlying fix has been available since June; what’s new is a working public exploit.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

Recommended action:<\/h3>\n<\/div>\n
\n
\n

Apply the latest kernel update for your distribution and reboot; where immediate patching isn’t possible, disable unprivileged user namespaces as an interim mitigation and verify KernelCare or equivalent live-patching is current.<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
\n
<\/div>\n<\/div>\n<\/div>\n
\n
\n
\n
\n
\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n

How to Check If Your Site Has Been Compromised<\/h3>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
\n

Because two of this week’s issues (the POUCO Import Users takeover and the NEX-Forms file deletion flaw) can leave visible signs on a website, it’s worth running through the following checks:<\/p>\n<\/p><\/div>\n<\/div><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<\/div>\n<\/div>\n

\n
\n
<\/div>\n<\/p><\/div>\n
\n
\n
\n
\n
\n