Weekly Cybersecurity Summary: 3 November to 9 November 2026

The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take.

This summary covers four of the week’s most significant issues: a WordPress core flaw that is now listed as exploited, a supply-chain compromise of the cPGuard security product, a data exposure flaw in the LiteSpeed Cache plugin, and a batch of critical Drupal module advisories.

WordPress core contains a race condition (CWE-367) in the way a full-package update stages files. During an update, a copy of the installer is placed in a predictable, web-accessible location under wp-content/upgrade, and for a short window a remote attacker who can reach it may be able to run code on the server. The fix shipped in WordPress 7.1.4 on 28 October 2026, and the issue was credited to Umut Bayram of Picus Security. The US cyber agency CISA added it to its Known Exploited Vulnerabilities catalogue on 3 November 2026. Wordfence reported tens of thousands of blocked probing attempts, which indicates attackers are looking for it, although no confirmed widespread compromise has been described. The WordPress project itself rates the issue as low severity because the window is only seconds long and the attack complexity is high.

On shared hosting, the risk arises whenever a site updates WordPress core, including automatic background updates, so it is worth making sure sites are already on a patched release.

On a VPS or dedicated server, you can additionally block public web access to the wp-content/upgrade directory at the web server level before updating.

Update WordPress to 7.1.4 or the fixed release for your branch, and block web access to wp-content/upgrade/ during updates where possible.

OPSSHIELD, the maker of the cPGuard security product for cPanel servers, disclosed that an attacker had hijacked its update system. A malicious script was delivered to servers in cPGuard versions 5.88.12 to 5.88.19 in the early hours of 2 November 2026 (UTC), and the issue was detected within roughly 12 hours. OPSSHIELD reports that about 2,950 customer servers ran the script. It collected sensitive files including account password hashes, root SSH keys, database configuration and shell history. The attacker is reported to have entered through a fake trial account and the billing portal.

Updating removes the backdoor but does not undo the theft of credentials. On shared hosting and VPS or dedicated servers that ran an affected version, treat root passwords, SSH keys, database credentials and any stored cloud keys as exposed, and review the server for signs of manual login.

Run cpgcli update –start, check for the persistence files named in the vendor guidance, rotate all credentials and SSH keys, and rebuild any server that shows signs of attacker access.

Patchstack published details on 4 November 2026 of a flaw in the LiteSpeed Cache WordPress plugin, credited to the researcher Santh. On WooCommerce stores, an unauthenticated visitor could obtain personal information from cart and checkout data through the Store API cart token. Patchstack scores it 7.5 but gives it a low priority and considers it unlikely to be exploited. The plugin has more than seven million installations, so the scale of exposure is large even if the risk per site is modest.

Shared hosting accounts running WooCommerce with this plugin are the most relevant, because the data involved is customer information.

VPS and dedicated server owners should check whether their sites use the plugin, and the same update also fixes related stored cross-site scripting issues.

Update LiteSpeed Cache to 7.9.2 or later, particularly on WooCommerce stores.

The Drupal Security Team published a batch of advisories for contributed modules on 4 November 2026, several rated Critical. The ones we are tracking most closely are REST & JSON API Authentication (CVE-2026-122067, fixed in 3.2.1), Commerce Product Alternative (CVE-2026-122070, fixed in 1.0.1), S3 File System CORS Upload (CVE-2026-122057, fixed in 1.3.0), Reset Password Email/SMS OTP (CVE-2026-122074, fixed in 1.0.5) and Content Synchronizer (CVE-2026-118547, fixed in 4.1.1). Further Critical and High advisories published the same day include Simple OAuth and OpenID Connect, Workflow Notifications, Highlight Js, Commerce Escrow and Islandora, and for several of these we have so far seen only a single source.

Only sites that have these specific modules installed are affected, which makes this mainly a concern for managed Drupal sites on VPS or dedicated servers where you control the codebase. On shared hosting, website owners will need to update the modules themselves.

Run composer outdated or drush pm:security on each Drupal site and update the listed modules to the fixed versions.

If you have questions or think your site may be affected, please raise a support ticket through the Customer Area at heartinternet.uk, or use live chat Monday to Friday, 09:30 to 16:00.

Our knowledge base is also available at heartinternet.uk/support/

We will keep customers updated as more information becomes available.