Weekly Cybersecurity Summary — 31 July to 6 August 2026

The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This week we’re covering five issues: two critical privilege escalations affecting cPanel & WHM (including its bundled Exim mail server and the ConfigServer firewall it now distributes), two WordPress plugin vulnerabilities that could lead to full site takeover, and a pair of Linux kernel local-root flaws affecting shared and VPS hosting platforms.

cPanel & WebPros published a coordinated security release on 4 August 2026 covering three separate issues found in cPanel & WHM and its bundled Exim mail transfer agent. The most serious, CVE-2026-58048, is a privilege escalation in the database management system: when a database is renamed, cPanel does not preserve the connection’s SQL mode, which allows SQL statements to execute in a root database context instead of the account holder’s own. Anyone with a cPanel account and access to the MySQL or MariaDB feature could use this to run database commands with full administrative privileges. The same release fixes CVE-2026-58047, an HTTP request-smuggling flaw in cpsrvd that, under limited conditions, can leak the credentials of other account holders on a shared server, and a separate local privilege escalation in Exim’s .forward pipe-transport handling that lets a Team User sub-account escalate to the primary cPanel account.

On shared hosting, this is patched at the platform level, so most website owners don’t need to take any action themselves. On a self-managed VPS or dedicated server running cPanel & WHM, the update needs applying directly, and administrators should check whether cpsrvd_keepalives_disabled=1 is set as an interim workaround for the request-smuggling issue if an immediate update isn’t possible.

Update WHM to the builds listed above as soon as possible; verify Exim is running 4.99.5 or later on any self-managed server.

cPanel published a further advisory on 5 August 2026, separate from the release above, covering multiple vulnerabilities in ConfigServer Security & Firewall (CSF), the firewall and login/intrusion detection package installed on the large majority of cPanel & WHM servers. CSF is now maintained as cPanel’s own fork following the original developer’s shutdown in 2025, so this falls under the same cPanel security channel as the database and Exim issues above. cPanel’s advisory is brief: it states only that the flaws “could allow an attacker to gain root access,” without publishing a CVE identifier, a CVSS score, or detail on whether exploitation requires local access or can be triggered remotely. Because CSF runs with root privileges to manage firewall rules and monitor logs, any flaw that lets attacker-influenced input reach it is significant regardless of the missing detail.

On shared hosting, this is a platform-level fix applied by us rather than something website owners need to act on. On a self-managed VPS or dedicated server running cPanel & WHM with CSF installed, treat this as a priority update given the stated root-access impact, even though the exploitation path hasn’t been detailed publicly yet.

Update CSF to 16.30-1 or later on all cPanel & WHM servers as soon as possible; there is no alternative mitigation published.

Researchers disclosed on 2 August 2026 that the POUCO Import Users plugin for WordPress performs no capability or nonce checks on the AJAX actions it exposes for creating and updating WordPress accounts. Because the plugin also trusts a role value supplied directly by the requester, an unauthenticated attacker can call the account-creation endpoint and simply specify “administrator” as the role, creating a fully privileged account without ever logging in. One vulnerability tracker classified this as an “Info” severity issue with a CVSS score of 0, which understates the real-world risk considerably: in practice this is a straightforward path to complete site takeover.

On shared hosting, check whether any of your sites have this plugin active and deactivate it as a precaution. On a VPS or dedicated server where you manage WordPress yourself, the same applies, and it’s worth checking the WordPress admin user list for any accounts you don’t recognise.

Deactivate and remove the POUCO Import Users plugin until an official fix is released; audit administrator accounts for unfamiliar entries.

Disclosed on 2 August 2026, this vulnerability sits in the NEX-Forms – Ultimate Form Builder Lite plugin’s delete_file() AJAX handler, which reads a file path from the database and passes it straight to PHP’s unlink() function without validating it against the real site path, a safe filename check, or an allow-list. A separate handler, insert_record(), lets an authenticated user store an arbitrary value in the database column the delete handler later trusts. Combined, this lets an attacker with admin-level access delete arbitrary files on the server, including wp-config.php, which can be used to force the site into a broken or reinstallable state.

Exploitation requires an admin-level account already, so this is primarily a risk where an attacker has already compromised a lower-privilege account or is an insider. Shared hosting website owners should update the plugin at the next opportunity; VPS and dedicated server administrators managing multiple WordPress installs should check all of them for the plugin.

Update NEX-Forms to the latest version beyond 9.2.3 on all affected sites.

Two unrelated Linux kernel local privilege escalation bugs came to wider attention this week. OVSwrap (CVE-2026-64531), disclosed on 28 July 2026 by researcher Asim Viladi Oglu Manizada, is a length-field wraparound in how the Open vSwitch kernel datapath converts userspace flow actions into internal Netlink attributes; an unprivileged local user who can create a user and network namespace can corrupt kernel memory and gain root, with no administrator interaction required. Separately, CVE-2026-53264 is a use-after-free race in the kernel’s network traffic-control code (net/sched/act_api.c), where an action can be looked up and its reference count raised under RCU read protection while a concurrent delete path frees the same object without waiting for the RCU grace period. This bug was patched upstream back in June, but gained fresh urgency on 28 July 2026 when STAR Labs published a working, AI-assisted root exploit against CentOS Stream 9.

Both flaws require local access, so the direct risk to website owners on well-isolated shared hosting is limited. The more significant exposure is on VPS and dedicated servers, particularly where multiple untrusted users or containers share a kernel: an attacker who gains any foothold, even a low-privilege one, can use either bug to reach root. For the net/sched bug specifically, check you’re already on a patched kernel rather than treating it as a brand-new vulnerability, since the underlying fix has been available since June; what’s new is a working public exploit.

Apply the latest kernel update for your distribution and reboot; where immediate patching isn’t possible, disable unprivileged user namespaces as an interim mitigation and verify KernelCare or equivalent live-patching is current.

Because two of this week’s issues (the POUCO Import Users takeover and the NEX-Forms file deletion flaw) can leave visible signs on a website, it’s worth running through the following checks:

If you have questions about any of the issues covered this week, or you’re not sure whether your website or server is affected, our support team is here to help.

We’re always happy to talk through anything that’s unclear, so don’t hesitate to get in touch.