Security Announcements
News from Security Announcements
Most website compromises are not sophisticated. They come from reused passwords, software that has not been updated, email domains without proper authentication and settings nobody got round to changing. This category covers security announcements that affect website and store owners, together with practical guidance on the measures that make the biggest difference.
Recent subjects include two-factor authentication, passkeys and how passwordless logins work, Argon2id password hashing in CubeCart, SPF, DKIM and DMARC for email, securing email accounts, hotlink protection, and how to tell whether a WordPress site is being used in attacks on others.
Where an announcement needs action from our customers, the article says what to do. If you think your own site has been compromised, our website malware monitoring and cleaning service covers detection and clean up, and hosting customers can raise any security concern as a support ticket.
Why Your Visitor Numbers Suddenly Exploded (And Why It Is Probably Not a Hack)
You open your analytics and something is badly wrong. There are fifty people on the site at once. They are in countries you have never sold to. Each one arrives, stays a few seconds, and vanishes. By the end of the day you have had twenty thousand visitors instead of the usual few hundred. The first thought is almost always the same one: have we […]
CubeCart Security Releases: What 6.7.3, 6.7.5 and 6.7.6 Fixed
Ten responsibly disclosed vulnerabilities were fixed across three CubeCart releases, including one rated CVSS 9.0. Here is what was found, and why authenticated-only is less reassuring than it sounds.
What an Attacker Can Do With a Free Subscriber Account
A vulnerability in a WordPress e-learning plugin let anyone who could fill in the registration form run commands on the server. What PHP object injection is, why “subscriber access required” is not the limitation it sounds like, and what to check on your own site.
The Plugin That Does Not Appear in Your Plugin List
WordPress has a second plugin directory that loads automatically and cannot be switched off from the dashboard. A malware sample analysed in September hides there, edits the screens that would reveal it, hides its own administrator account, and rebuilds itself if you delete the file. What to check, and why deleting files first is the wrong move.
Is Your Website Already Using Quantum-Resistant Encryption?
Encrypted traffic captured today can be decrypted years from now, which is why post-quantum encryption matters already. What it actually is, why almost nobody had to do anything to get it, and a twenty-second check you can run on your own site.
How One Link Can Make You Create an Attacker’s Admin Account
A flaw in the Elementor page builder let a single link, opened by a logged-in administrator, create a second administrator account for whoever sent it. What cross-site request forgery is, why this one reached the whole of the WordPress REST API, and the checks worth running.
A Critical WordPress Flaw, and the Shrinking Gap Between Patch and Attack
WordPress shipped an emergency fix for a critical flaw on 22 September, backported across twenty-five branches. Attackers were probing for it the same day. What the flaw actually is, how to tell whether your site is patched, and why a weekly update cycle is no longer fast enough.
Magecart Attacks: How Card Skimming Works and How to Stop It
Magecart injects JavaScript into your checkout to copy card details as customers type. The shop keeps working, the order completes, and nothing looks broken. Here is how it gets in and what actually reduces the risk.
CubeCart Audit, Request and Error Logs: Knowing What Your Store Did
CubeCart now records every admin action with actor, IP and a diff, logs outbound HTTP calls, and deduplicates error rows so the log is actually readable.
How One Plugin Can Let an Attacker Upload a Backdoor
A live attack campaign against a WooCommerce plugin shows how file upload flaws work, why patched sites are still being hit, and the checks worth running.
- 1
- 2