> ## Documentation Index
> Fetch the complete documentation index at: https://blog.onetsolutions.net/llms.txt
> Use this file to discover all available pages before exploring further.

# Security advisories

> Every critical vulnerability we have analysed, newest first. Subscribe to the RSS feed to get the next one.

We publish an analysis and a mitigation guide whenever a critical vulnerability affects the stacks our customers run — Linux kernel, web servers, databases, container orchestration, WordPress.

Subscribe to this page's RSS feed with the button above. New advisories land there as they are published, which beats remembering to check.

<Update label="12 August 2026" description="CVE-2026-42533 · major" tags={["nginx"]} rss={{title: "nginx (CVE-2026-42533): two heap overflows, and why patching the first did not fix the second", description: "A buffer overflow in nginx's map-and-regex handling affects fifteen years of releases. If you patched for Nginx Rift in May, you are still exposed."}}>
  A heap overflow in nginx's two-pass script engine, reachable through a regex-based `map` feeding a directive that also uses a regex capture. Affects 0.9.6 through 1.31.2.

  The trap: the May fix for Nginx Rift (CVE-2026-42945, fixed in 1.30.1) does not cover this one. Update to 1.30.4 or 1.31.3. [Read the full advisory](/en/nginx-map-regex-cve-2026-42533)
</Update>

<Update label="12 August 2026" description="CVE-2026-54420 · CVSS 8.5" tags={["cPanel", "LiteSpeed", "Exploited"]} rss={{title: "LiteSpeed cPanel plugin (CVE-2026-54420): from an FTP account to root on a shared server", description: "A symlink flaw lets any account with FTP or shell access reach root on shared hosting. In CISA's KEV catalog since June — check your plugin version."}}>
  Symlink mishandling in the LiteSpeed cPanel plugin lets an account with nothing more than FTP access escalate to root on shared hosting running CloudLinux or CageFS.

  In CISA's KEV catalog since 15 June. Fixed in LiteSpeed WHM plugin 5.3.2.1. [Read the full advisory](/en/litespeed-cpanel-cve-2026-54420)
</Update>

<Update label="8 August 2026" description="CVE-2026-63030 · CVSS 9.8" tags={["WordPress", "Exploited"]} rss={{title: "wp2shell (CVE-2026-63030): unauthenticated RCE in WordPress core", description: "A batch-API routing flaw chained with an SQL injection gives full site takeover without credentials. Patched in 6.9.5 and 7.0.2, and exploited in the wild."}}>
  A routing confusion in the WordPress REST API batch processor, chained with an SQL injection, gives full site takeover without any credentials. Added to CISA's KEV catalog on 21 July and exploited in the wild.

  Patched in 6.9.5 and 7.0.2. [Read the full advisory](/en/wp2shell-cve-2026-63030)
</Update>

<Update label="8 August 2026" description="CVE-2026-18072 · CVSS 9.8" tags={["WordPress", "Supply chain"]} rss={{title: "The ARVE backdoor (CVE-2026-18072): when the supply chain is the vulnerability", description: "A WordPress plugin with 20,000 installs shipped a hardcoded admin backdoor. What happened, how to check your sites, and what it changes about plugin trust."}}>
  Not a bug but an intent: version 10.8.7 of a WordPress plugin with 20,000 installs shipped a hardcoded administrator backdoor. Caught in under two hours, and pulled from WordPress.org.

  There is no fixed version — remove the plugin. [Read the full advisory](/en/arve-backdoor-cve-2026-18072)
</Update>

<Update label="8 August 2026" description="CVE-2026-43499 · CVSS 7.8" tags={["Linux kernel", "Containers"]} rss={{title: "GhostLock (CVE-2026-43499): fifteen years of kernel, root in five seconds", description: "A use-after-free in the kernel futex priority-inheritance path turns any local user into root and escapes containers. No workaround — only a reboot."}}>
  A use-after-free on the futex priority-inheritance path, present since 2011, turns any local user into root in about five seconds and escapes containers to the host.

  No runtime mitigation exists: patch the kernel and reboot. [Read the full advisory](/en/ghostlock-cve-2026-43499)
</Update>

<Update label="1 May 2026" description="CVE-2026-31431" tags={["Linux kernel", "Containers"]} rss={{title: "Copy Fail (CVE-2026-31431): Linux kernel local privilege escalation", description: "A critical Linux kernel cryptographic-subsystem flaw lets a local user become root. Analysis, scope, and mitigation."}}>
  A flaw in the kernel's cryptographic subsystem, reachable through the AF\_ALG interface, lets locally-running code walk out with root. Container escape included.

  A module blacklist mitigates it until the kernel patch lands. [Read the full advisory](/en/copy-fail-cve-2026-31431)
</Update>

<Update label="10 December 2025" description="CVE-2025-55182 · CVSS 10.0" tags={["React", "Exploited"]} rss={{title: "React2Shell (CVE-2025-55182): unauthenticated RCE in React Server Components", description: "Unsafe deserialisation in React 19's Flight protocol allows arbitrary code execution on the server. CVSS 10.0, active exploitation."}}>
  Unsafe deserialisation in React 19's Flight protocol allows arbitrary code execution on the server, unauthenticated. A perfect 10.0, with active exploitation.

  [Read the full advisory](/en/react2shell-cve-2025-55182)
</Update>

<Update label="1 December 2025" description="CVE-2025-14847" tags={["MongoDB", "Data leak"]} rss={{title: "MongoBleed (CVE-2025-14847): unauthenticated MongoDB memory leak", description: "A flaw in MongoDB's network layer leaks fragments of server RAM — credentials, API keys, BSON — to unauthenticated attackers."}}>
  MongoDB's network layer leaks fragments of server memory to unauthenticated clients — credentials, API keys and BSON documents among them.

  [Read the full advisory](/en/mongobleed-cve-2025-14847)
</Update>

<Update label="21 October 2025" description="CVE-2025-49844" tags={["Redis"]} rss={{title: "RediShell (CVE-2025-49844): Redis Lua sandbox escape to RCE", description: "A malicious Lua script exploits a use-after-free in Redis's embedded engine to execute native code on the host. Public PoC."}}>
  A malicious Lua script escapes the Redis sandbox through a use-after-free in the embedded engine and runs native code on the host. Public proof of concept.

  [Read the full advisory](/en/redishell-cve-2025-49844)
</Update>

<Update label="26 March 2025" description="Four chained CVEs" tags={["Kubernetes"]} rss={{title: "Ingress Nightmare: unauthenticated RCE on Kubernetes clusters (Ingress NGINX)", description: "Four chained CVEs in the Ingress NGINX controller let an unauthenticated attacker run code and ultimately take over the cluster."}}>
  Four chained flaws in the Ingress NGINX controller take an unauthenticated attacker from a request to code execution, and from there to the whole cluster.

  [Read the full advisory](/en/ingress-nightmare-kubernetes-2025)
</Update>

<Update label="27 September 2024" description="CVE-2024-47076 and friends" tags={["CUPS", "Linux"]} rss={{title: "CUPS: remote code execution via cups-browsed (CVE-2024-47076 and friends)", description: "Four chained CUPS flaws let an attacker register a malicious printer and gain RCE when a user prints to it."}}>
  Four chained CUPS flaws let an attacker register a malicious printer on your network and obtain code execution the moment someone prints to it.

  [Read the full advisory](/en/cups-rce-2024)
</Update>

<Update label="2 July 2024" description="CVE-2024-6387" tags={["OpenSSH"]} rss={{title: "RegreSSHion (CVE-2024-6387): unauthenticated RCE in OpenSSH", description: "A regression of a 2006 OpenSSH bug reappears in recent versions and allows remote code execution as root, without authentication."}}>
  A 2006 bug reintroduced by a regression: recent OpenSSH versions allow remote code execution as root, with no authentication.

  [Read the full advisory](/en/regresshion-cve-2024-6387)
</Update>

<Update label="2 April 2024" description="CVE-2024-3094" tags={["Supply chain", "Linux"]} rss={{title: "xz-utils backdoor (CVE-2024-3094): a textbook supply-chain attack", description: "A deliberate backdoor planted in xz-utils 5.6.0 and 5.6.1 targeted OpenSSH via systemd. Caught early, narrow blast radius — but the lesson is huge."}}>
  A backdoor deliberately planted in xz-utils 5.6.0 and 5.6.1, targeting OpenSSH through systemd. Caught before it reached stable distributions.

  [Read the full advisory](/en/xz-backdoor-cve-2024-3094)
</Update>

<Info>
  Hardening your servers day to day is a different exercise from reacting to a CVE. Our [enhanced VPS security guide](/en/enhanced-vps-linux-security) covers the tools and habits, and the [WordPress hardening checklist](/en/secure-wordpress-after-wp2shell) covers the web side.
</Info>