The Heart Internet Team is aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This summary covers four issues: a WordPress migration plugin, the PHP language runtime itself, the BIND DNS server, and a Linux kernel local privilege escalation.
[Critical] Duplicator and Duplicator Pro PHP Object Injection (CVE-2026-82814)
A vulnerability published on 26 September 2026 in Addify’s Request a Quote for WooCommerce plugin allows any visitor, without logging in, to upload a file of their choosing through the plugin’s quote pop-up form. The form handler does not check the type or extension of uploaded files, so an attacker can upload a PHP script and then run it on the server. The issue was reported by the researcher t4g0 and published through Wordfence. At the time of writing, no fixed version had been documented. The plugin is sold through the WooCommerce marketplace rather than WordPress.org, which means it may not update automatically in the way many free plugins do.
Affected:
Duplicator up to and including 1.5.17; Duplicator Pro up to and including 4.6.10.
Fixed version:
Update to the latest release from the plugin author. The CVE record does not state a fixed version, and the changelog points to the 5.0.0 release.
CVSS:
8.8 (High), CVSS 3.1, CWE-502. No account needed to plant the data; an administrator action triggers it.
What This Means For You:
On shared hosting, any WordPress site running an affected Duplicator version could be exposed if an administrator runs a migration while a planted object is present. On a VPS or dedicated server, successful exploitation may allow command execution as the web user, so review any site that has used Duplicator recently.
Recommended Action:
Update Duplicator or Duplicator Pro through the WordPress dashboard, or remove the plugin if it is no longer needed. Avoid running migrations or imports until updated.
[Critical] PHP2Shell: Two PHP Use-After-Free Flaws (CVE-2026-109618, CVE-2026-109619) and a Session Upload Progress Issue (CVE-2026-115560)
Two use-after-free vulnerabilities (CWE-416) in PHP core were leaked on 20 October and fixed in emergency releases on 21 October 2026. A proof of concept is reported to exist. The Canadian Cyber Centre has not identified active exploitation but warns this could change quickly. On 23 October the PHP Security Team also published details of a third issue, CVE-2026-115560, in session upload progress, which the 21 October releases do not fix. It needs an uncommon mix of configuration and application behaviour.
Affected:
PHP 8.5 before 8.5.12, 8.4 before 8.4.27, 8.3 before 8.3.36 and 8.2 before 8.2.35. PHP 8.1 and older no longer receive project updates; check with your distribution for backports.
Fixed version:
8.5.12, 8.4.27, 8.3.36, 8.2.35 (the first two CVEs). No fix yet for CVE-2026-115560.
CVSS:
CVSS 4.0 9.2 for CVE-2026-109618 and CVE-2026-109619 (as recorded in earlier briefings).
What This Means For You:
On shared hosting, PHP is updated centrally and customers should check their selected PHP version in the control panel. On a VPS or dedicated server, update PHP through your package manager or control panel, and review any older PHP versions that depend on unofficial backports.
Recommended Action:
Update PHP to a fixed release. Until CVE-2026-115560 is fixed, set session.upload_progress.enabled=0 in php.ini.
[High] BIND 9 Multiple Vulnerabilities including Possible Remote Code Execution (CVE-2026-94300, CVE-2026-19630, CVE-2026-96888, CVE-2026-97313)
ISC released BIND 9.20.30 and 9.21.27 to fix four flaws, made public on 21 October 2026. The most serious, CVE-2026-94300, is a memory corruption issue in concurrent GSS-TSIG handling that could lead to remote code execution, though a replay is required. CVE-2026-19630 is an amplified resource exhaustion denial of service (CVSS 7.5), and CVE-2026-96888 and CVE-2026-97313 are assertion failures that can stop the service (CVSS 7.5 each).
Affected:
BIND 9 releases prior to 9.20.30 and 9.21.27.
Fixed version:
9.20.30 and 9.21.27.
CVSS:
8.1 for CVE-2026-94300; 7.5 for the other three.
What This Means For You:
If you run BIND as a DNS server on a VPS or dedicated server, particularly with GSS-TSIG, redirect zones or response policy zones configured, you should update. Shared hosting customers are not directly affected.
Recommended Action:
Update BIND to 9.20.30 or 9.21.27 through your distribution or control panel.
[High] Linux Kernel Local Root via skb_zerocopy (ZDI-CAN-33367, no CVE yet)
A flaw in the Linux kernel networking code lets an unprivileged local user change the cached contents of files they can only read, including root-owned files, leading to root access. It was leaked to public mailing lists on 21 October 2026 with a working proof of concept, and AlmaLinux published patched testing kernels on 23 October. It bypasses the earlier Dirty Frag fix. No exploitation in the wild has been reported.
Affected:
AlmaLinux 8, 9 and 10, Debian 12 and 13, Ubuntu 24.04 and CloudLinux 9 and 10 (root verified by vendors). CentOS 6 and 7 are not vulnerable.
Fixed version:
AlmaLinux testing kernels 4.18.0-553.177.2, 5.14.0-687.59.2 and 6.12.0-211.68.2; other distributions awaited.
CVSS:
7.8 (High), as scored by the Zero Day Initiative.
What This Means For You:
The risk is highest on servers where untrusted users have shell access, such as shared hosting and VPS plans with customer accounts. A website vulnerability could also be chained with this flaw to gain root.
Recommended Action:
Until patched kernels are installed and the server rebooted, set user.max_user_namespaces=0 where not needed, or block the esp4 and esp6 modules (this breaks IPsec).
How to Check If Your Site Has Been Compromised
- Unfamiliar administrator accounts in the WordPress Users list.
- Recently modified or unknown PHP files, especially in wp-content/uploads or the site root.
- A missing or altered wp-config.php.
- Unexpected outbound connections, scheduled tasks or high CPU usage.
- Search results or pages showing spam content or unexpected redirects.
If you find any of these, change all passwords, restore from a clean backup and contact us.
Frequently Asked Questions
Do I need to do anything if I use shared hosting?
Which PHP version should I use?
Is the kernel issue being exploited?
Does the BIND issue affect my website?
How do I update a WordPress plugin?
Where can I check my PHP version?
Summary
| Vulnerability | CVE | CVSS | Affected | Fixed | Action |
| Duplicator object injection | CVE-2026-82814 | 8.8 | Duplicator <=1.5.17, Pro <=4.6.10 | Latest release | Update plugin |
| PHP2Shell use-after-free | CVE-2026-109618, CVE-2026-109619 | 9.2 (4.0) | PHP 8.2-8.5 before fixed releases | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | Update PHP |
| PHP session upload progress | CVE-2026-115560 | n/a | PHP 8.2-8.5 | Not yet | Disable upload_progress |
| BIND 9 multiple flaws | CVE-2026-94300, CVE-2026-19630, CVE-2026-96888, CVE-2026-97313 | 8.1 / 7.5 | BIND before 9.20.30 / 9.21.27 | 9.20.30, 9.21.27 | Update BIND |
| Kernel skb_zerocopy LPE | ZDI-CAN-33367 | 7.8 | Alma 8/9/10, Debian 12/13, Ubuntu 24.04 | Testing kernels | Mitigate, patch, reboot |
Need Help? Get in Touch
If you need help with any of the above, raise a support ticket through the Customer Area at heartinternet.uk, use live chat Monday to Friday 09:30 to 16:00, or visit the knowledge base at heartinternet.uk/support.
We are here to help you keep your websites and servers secure.
