Weekly Cybersecurity Summary — 4 September to 10 September 2026

The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help website owners understand what they mean, who may be affected, and what sensible steps to take. This week’s issues span a critical cPanel and WHM flaw affecting virtually every shared hosting environment, two critical WordPress plugin vulnerabilities, two actively exploited Windows zero-days from September’s record-breaking Patch Tuesday, and a libxml2 security release affecting PHP’s XML processing across all major Linux distributions.

cPanel’s EmailTrack feature monitors and reviews email delivery activity, including message routing and delivery information, and is present on virtually every cPanel and WHM server. cPanel found that the feature is vulnerable to SQL injection that an authenticated account holder with mail-related privileges can use to create arbitrary files anywhere on the underlying server. Because those files can be placed where they will be executed with root privileges, a low-tier account with nothing more than ordinary mail permissions is enough to take over the entire server. The flaw was disclosed by cPanel on 8 September 2026, with the CVE record published the following day.

On shared hosting, any account with mail privileges on an unpatched server, however small, could in principle be used to compromise every other website, database and email account on that same machine. On VPS or dedicated servers the risk is limited to that one server, but full compromise should be assumed until it is patched.

Update to the fixed builds above without delay. If your server updates automatically it should already be covered; otherwise force the update through WHM or by running /scripts/upcp –force as root.

Mail Mint is an email marketing and automation plugin for WordPress and WooCommerce, with around 5,000 active installs. Researchers found that its handle_form_submission function deserialises user-supplied input without validating it first, allowing an unauthenticated attacker to inject a specially crafted PHP object. Combined with a gadget chain already present in the plugin’s own code, that object can be used to execute arbitrary code on the server with no login required at all. The issue was disclosed on 5 September 2026.

Any website using Mail Mint for email automation should treat this as an urgent update, particularly given how little an attacker needs to exploit it.

Update Mail Mint to the latest version immediately, or remove the plugin if it is not actively in use.

Hummingbird Performance is a caching and page-speed optimisation plugin from WPMU DEV, with more than 100,000 active installs. The plugin writes a debug log to a web-accessible file that is supposed to be protected by a line of PHP that stops the file being executed directly. Researchers found that a coding mistake in how that protection is applied means the guard is never actually written to the log, and because the log also records raw cookie values without sanitising them, an attacker can set a cookie containing PHP code, wait for the plugin to log it, and then request the log file directly to have the server run that code. No login is required at any point. The issue was disclosed on 5 September 2026.

Given the plugin’s large install base, this is one of the more widely relevant WordPress issues this week; any site running an affected version is exposed regardless of hosting type.

Update Hummingbird Performance to 3.21.1 or later immediately, and check the wp-content/wphb-logs/ folder for any unfamiliar or recently modified files.

Microsoft’s September 2026 Patch Tuesday, released 8 September, was the largest security update in the company’s history, addressing close to 966 vulnerabilities across Windows, Office, Exchange Server, SQL Server and Azure. Two of the Windows fixes closed local elevation-of-privilege flaws that Microsoft confirmed were already being exploited before patches were available. CVE-2026-81963 is a link-following flaw in the Windows Update Stack that lets an attacker who already has low-privileged code execution on a machine escalate to full SYSTEM access; Microsoft notes this is the first Windows Update Stack zero-day exploited in the wild since 2022. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the mechanism Windows processes use to communicate internally, that lets an attacker already running code inside a low-privilege sandboxed AppContainer escape it and reach SYSTEM.

Both flaws require an attacker to already have some form of code execution on the machine, so they typically follow an initial compromise rather than providing one directly; the fact that both were exploited before a patch existed means any Windows Server host that has not yet applied this month’s update should be treated as potentially at risk.

Apply the September 2026 cumulative update to all Windows Server and Windows 11 hosts without delay, and review for signs of prior compromise if patching has been delayed.

libxml2 is the XML parsing library behind PHP’s DOMDocument and SimpleXML extensions, used directly or indirectly by WordPress, Drupal and most other PHP-based platforms. On 6 September 2026, the project shipped version 2.15.4, fixing eight separate memory-safety issues across its parsing, validation and XPointer code. The most severe, CVE-2026-86140, is a stack-based buffer overflow in the xmlSnprintfElements() function caused by an unchecked strcat() call, rated CVSS 8.0. The remaining seven cover an out-of-bounds read during regular-expression parsing, two integer overflows that can lead to heap corruption, a NULL pointer dereference, a heap buffer overflow in XPointer handling, an integer-coercion issue that can reach write callbacks, and a flag-propagation bug in XInclude processing that can enable XXE, SSRF or denial of service.

This is a platform-level library rather than a flaw in any specific website, so the practical risk depends on how quickly an updated package reaches your server. Hosting providers should prioritise rolling the update out across their PHP stacks.

Update libxml2 to 2.15.4 or later as soon as your distribution’s package is available, and restart PHP-FPM, Apache or Nginx workers afterwards so the new library is loaded.

If you have questions about any of the issues covered in this summary, or need help checking your hosting environment, you can raise a support ticket via the Customer Area at heartinternet.uk, or chat with our live support team Monday to Friday, 09:30–16:00. You can also browse our knowledge base at heartinternet.uk/support for step-by-step guides.

We’re here to help keep your website secure.