Security notices
Urgent alerts about software websites run on.
When a widely used piece of website software has a serious flaw, a breach or a backdoor, we post a notice here: what happened, whether it affects you, and exactly what to update or change. Newest first.
For everyday problems like an expired padlock or an exposed file, see all fix guides.
- WP Project Manager WordPress plugin CVE-2026-116512, rated 9.8, October 31, 2026: update to 4.1.2 · Check today · Updated Nov 1, 2026, 9:44 AM ET
- Gravity Forms WordPress plugin CVE-2026-103039, rated 9.8, reported exploited, October 29, 2026: update to 3.1.3 or later · Check today · Updated Nov 1, 2026, 9:43 AM ET
- PDF Invoice for WooCommerce plugin CVE-2026-109220, rated 9.8, October 30, 2026: update to 7.2.0 · Check today · Updated Oct 31, 2026, 10:12 PM ET
- Northflank security incident, October 30, 2026: assume every environment variable is exposed and rotate all keys · Check today · Updated Nov 1, 2026, 9:43 AM ET
- FunnelKit Automations WordPress plugin CVE-2026-39738, rated 9.8, October 30, 2026: update to 3.8.6.2 · Check today · Updated Oct 31, 2026, 12:44 PM ET
- DebugBear monitoring script used to drain Polymarket accounts, October 29, 2026: remove the DebugBear RUM script from your site · Check today · Updated Oct 31, 2026, 12:43 PM ET
- Drupal Commerce Core CVE-2026-118539, exploited in the wild, October 28, 2026: update to 3.3.13 or 8.x-2.41 and audit your orders · Check today · Updated Oct 31, 2026, 12:43 PM ET
- Pie Register Premium WordPress plugin CVE-2026-84999, rated 9.8, October 28, 2026: update to 3.8.4.1 or deactivate it · Check today · Updated Oct 31, 2026, 12:42 PM ET
- WordPress 7.1.4 security release, October 28, 2026: attack attempts seen on the updater flaw, update now · Check today · Updated Oct 31, 2026, 12:42 PM ET
- Linux kernel CVE-2026-98432, October 15, 2026: update your server's kernel and reboot · Check today · Updated Nov 2, 2026, 7:32 AM ET
- Adobe Campaign Classic APSB26-162, eight critical fixes, October 27, 2026: install build 9403 on self-run installs · Check today · Updated Oct 28, 2026, 9:08 AM ET
- Prime Mover WordPress plugin CVE-2026-115806, rated 9.8, October 2026: update to 2.2.2 before your next export · Check today · Updated Oct 28, 2026, 9:02 AM ET
- Convertr checkout card skimmer and Plausible CE CVE-2026-8467, October 2026: update Plausible and check your checkout scripts · Check today · Updated Oct 28, 2026, 9:01 AM ET
- Bubble security incident, October 26, 2026: check your API keys and editor setting · Check today · Updated Oct 27, 2026, 8:22 AM ET
- DreamHost email and FTP password resets, October 23, 2026: set new passwords · Check today · Updated Oct 27, 2026, 8:20 AM ET
- Tailscale and headscale Tailworm report, October 25, 2026: Tailscale fix out (1.104.4), headscale still unfixed, update and tighten your SSH settings · Check today · Updated Oct 28, 2026, 9:05 AM ET
- HPE Aruba AOS-8 and AOS-10 wireless critical fixes, October 22, 2026: update in your next maintenance window · Check today · Updated Oct 27, 2026, 7:46 AM ET
- Pillow Python image library security fixes, version 13.0.0, October 16, 2026: upgrade sites that handle image uploads · Check today · Updated Oct 25, 2026, 8:12 AM ET
- PingCAP TiDB Cloud breach, disclosed October 19, 2026: replace your API keys · Check today · Updated Oct 25, 2026, 12:58 AM ET
- Magento CMS block loader hiding from scanners, October 2026: check your store's database · Check today · Updated Oct 28, 2026, 9:06 AM ET
- Magento and Adobe Commerce BlockStrap CVE-2026-103849, rated 10.0, October 2026: install the October patch · Check today · Updated Oct 25, 2026, 12:57 AM ET
- Nextcloud Collabora Built-in CODE Server app CVE-2026-110447, exploited, October 2026: update or remove the app · Check today · Updated Oct 24, 2026, 9:25 AM ET
- Cisco Snort 3, Expressway and Unified CM critical fixes, October 21, 2026: update in your next maintenance window · Check today · Updated Oct 23, 2026, 10:16 AM ET
- WordPress XSS2Shell CVE-2026-64638, fixed August 6, 2026: exploit tools now public, check your version · Check today · Updated Oct 22, 2026, 4:51 PM ET
- Arista VeloCloud Orchestrator CVE-2026-114625, exploited, October 22, 2026: update your on-premises orchestrator · Check today · Updated Oct 25, 2026, 12:27 AM ET
- Duplicator WordPress plugin CVE-2026-82814, October 20, 2026: update before your next migration · Check today · Updated Oct 22, 2026, 3:58 PM ET
- SiteGuard Server Edition CVE-2026-106931, being exploited, October 14, 2026: update your server firewall · Check today · Updated Oct 22, 2026, 3:52 PM ET
- Node.js CVE-2026-111497 Brotli flaw, October 21, 2026: update every Node.js server · Check today · Updated Oct 28, 2026, 9:04 AM ET
- Laravel CVE-2026-114509 login bypass, October 19, 2026: update your Laravel app · Check today · Updated Oct 22, 2026, 2:44 PM ET
- Shopify apps sent shoppers to fake checkout pages, October 2026: test your checkout · Check today · Updated Oct 22, 2026, 2:43 PM ET
- Railway breach, October 21, 2026: rotate your payment, database and API keys · Check today · Updated Oct 22, 2026, 2:42 PM ET
- eMudhra certificates distrusted, October 2026: check your padlock before October 27 · Check today · Updated Oct 22, 2026, 7:47 PM ET
- GitLab CVE-2026-110264 critical flaw, October 21, 2026: update your own GitLab server · Check today · Updated Nov 2, 2026, 8:12 AM ET
- Stolen UpdraftCentral keys used to backdoor WordPress sites, October 2026: what to do · Check today · Updated Oct 21, 2026, 4:11 PM ET
- LiteLLM 1.107.0 backdoored release, October 21, 2026: what to do · Check today · Updated Oct 25, 2026, 12:59 AM ET
- PHP critical security release, October 21, 2026: what to do · Fix today · Updated Oct 31, 2026, 12:54 PM ET