Server Security

Supermicro BMC Vulnerabilities Hit 392 Boards, One Rated CVSS 9.8

• Vulnerability Report

Supermicro BMC Vulnerabilities Hit 392 Boards, One Rated CVSS 9.8

Do Son October 28, 2026 0

Supermicro BMC vulnerabilities hit 392 boards. Critical IPMI flaw CVE-2026-18450 (CVSS 9.8) lets attackers run commands. Update BMC firmware now.

HPE Fixes Critical iLO 7 Admin Access Flaw and iMC Authentication Bypass

• Vulnerability Report

HPE Fixes Critical iLO 7 Admin Access Flaw and iMC Authentication Bypass

Do Son October 9, 2026 0

HPE fixes a critical HPE iLO 7 vulnerability, CVE-2026-79820, and iMC authentication bypass CVE-2026-79842. Update iLO to 1.25.01 now.

Apache Fesod SSRF Vulnerability Exposes Internal Networks

• Vulnerability Report

Apache Fesod SSRF Vulnerability Exposes Internal Networks

Do Son June 2, 2026 0

A critical Apache Fesod SSRF vulnerability has been found. Learn about the CVE-2026-49328 patch released to protect internal network resources.

Severe Plesk Privilege Escalation Flaw Patched in Linux Versions

• Vulnerability Report

Severe Plesk Privilege Escalation Flaw Patched in Linux Versions

Do Son June 1, 2026 0

Secure your servers against a major Plesk privilege escalation flaw. Learn how the latest CVE-2026-44962 patch protects Linux infrastructure.

Comet Backup Server Flaw Exposes Remote Customer Data

• Vulnerability Report

Comet Backup Server Flaw Exposes Remote Customer Data

Do Son May 31, 2026 0

A critical Comet Backup RCE vulnerability has been found. Learn about the CVE-2026-32999 patch released to secure backup servers and user data.

cPanel & WHM Patch 5 High-Severity Flaws, Including 8.6 Severity File Read and SQLi

• Vulnerability Report

cPanel & WHM Patch 5 High-Severity Flaws, Including 8.6 Severity File Read and SQLi

Do Son May 15, 2026 0

cPanel & WHM fix 5 critical vulnerabilities (CVE-2026-29205). Fixes for arbitrary file read, SQLi, and privilege escalation are now live. Update now!

44,000 IPs Hijacked: cPanel’s 9.8 CVSS Authentication Bypass Triggers Global Ransomware Surge

• Vulnerability Report

44,000 IPs Hijacked: cPanel’s 9.8 CVSS Authentication Bypass Triggers Global Ransomware Surge

Do Son May 2, 2026 0

CISA warns of cPanel CVE-2026-41940 (CVSS 9.8). 44,000 IPs compromised via authentication bypass, fueling ransomware and botnets. Patch by May 3rd!

Exploited in the Wild: PoC Released for cPanel CVE-2026-41940 Authentication Bypass Zero-Day

• Vulnerability Report

Exploited in the Wild: PoC Released for cPanel CVE-2026-41940 Authentication Bypass Zero-Day

Do Son April 29, 2026 0

cPanel issues emergency patches for a critical authentication vulnerability affecting all supported versions. Run /scripts/upcp --force immediately to patch.

Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

• Malware

Pay2Key’s New Linux Ransomware Strips Server Defenses to Hijack x64 and ARM64 Infrastructure

Do Son March 30, 2026 0

Morphisec uncovers Pay2Key’s Linux evolution. This dual-arch ransomware disables SELinux and AppArmor to encrypt x64/ARM64 servers. Secure your infra today!

Leaving the Doors Unlocked: Critical 9.0 CVSS ScreenConnect Flaw Exposes Machine Keys

• Vulnerability Report

Leaving the Doors Unlocked: Critical 9.0 CVSS ScreenConnect Flaw Exposes Machine Keys

Do Son March 18, 2026 0

A critical 9.0 CVSS vulnerability (CVE-2026-3564) in ConnectWise ScreenConnect exposes server cryptographic keys. On-premise users must update to 26.1 now.

High-Severity Flaw Exposes LiteSpeed Web Servers to OS Command Injection

• Vulnerability Report

High-Severity Flaw Exposes LiteSpeed Web Servers to OS Command Injection

Do Son March 16, 2026 0

An 8.6 CVSS flaw (CVE-2026-31386) in LiteSpeed Web Server editions allows OS command injection and system compromise. Restrict WebAdmin access immediately.

Total Takeover Threat: Critical IceWarp Flaws Trigger Emergency Server Patches

• Vulnerability

Total Takeover Threat: Critical IceWarp Flaws Trigger Emergency Server Patches

Do Son February 23, 2026 0

IceWarp urges immediate patching for critical flaws allowing unauthorized server access, XSS, and arbitrary file reading. Update your instances today.

CVE-2026-26016: Critical Pterodactyl API Flaw (CVSS 9.2) Exposes Entire Server Networks

• Vulnerability Report

CVE-2026-26016: Critical Pterodactyl API Flaw (CVSS 9.2) Exposes Entire Server Networks

Do Son February 19, 2026 0

Critical Pterodactyl API flaw (CVE-2026-26016) allows cross-node authorization bypass. Attackers can destroy game servers. Update to version 1.12.1 now.

Attacking from Within: How Adobe ColdFusion Admins Can Weaponize Remote Shares

• Vulnerability Report

Attacking from Within: How Adobe ColdFusion Admins Can Weaponize Remote Shares

Do Son January 6, 2026 0

Adobe patches a critical ColdFusion flaw (CVE-2025-61808) that uses remote SMB shares and CAR files to bypass security and achieve total server takeover.

CRITICAL ALERT: Windows Server WSUS Flaw Actively Exploited (CVE-2025-59287, CVSS 9.8)

• Vulnerability Report

CRITICAL ALERT: Windows Server WSUS Flaw Actively Exploited (CVE-2025-59287, CVSS 9.8)

Do Son October 25, 2025 0

Microsoft released an emergency update for a critical WSUS flaw (CVSS 9.8) that allows unauthenticated RCE and is already being actively exploited.

Critical Flaw in Fabio Load Balancer Allows HTTP Header Tampering & Access Bypass

• Vulnerability

Critical Flaw in Fabio Load Balancer Allows HTTP Header Tampering & Access Bypass

Do Son June 2, 2025 0

A critical flaw in Fabio load balancer allows malicious clients to manipulate or strip HTTP headers, leading to potential access control bypass. Upgrade to 1.6.6.

CVE-2025-2774: Webmin Vulnerability Allows Root-Level Privilege Escalation

• Vulnerability

CVE-2025-2774: Webmin Vulnerability Allows Root-Level Privilege Escalation

Do Son May 4, 2025 0

A critical vulnerability (CVE-2025-2774) in Webmin allows remote attackers to escalate privileges and execute code as root. Update to version 2.302 now.