Weekly Cybersecurity Summary – 7 August to 13 August 2026

The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This week we’re covering five issues: two WordPress core vulnerabilities patched in back-to-back security releases, a WordPress plugin ecosystem supply-chain attack that is actively being exploited, Microsoft’s August Patch Tuesday (including a zero-day already exploited in the wild), and a Linux kernel flaw allowing a KVM guest to escape to its host.

Researchers disclosed on 7 August 2026 that a chain of issues in WordPress core, nicknamed XSS2Shell, lets an unauthenticated attacker go from a single failed login attempt to full remote code execution. The chain starts with a reflected cross-site scripting flaw on the login screen: an attacker can inject DOM content that WordPress’s own auto-executing core script then processes. From there, the attack uses a REST API JSONP callback together with a same-origin method execution trick to reach into an administrator’s browser tab and steal their Application Password. With that password in hand, the attacker can install a malicious plugin and execute code on the server. The root cause traces back through every WordPress release since version 4.7.

On shared hosting, this is patched at the platform level as part of routine WordPress core updates, so most website owners don’t need to take any separate action. On a VPS or dedicated server where you manage WordPress updates yourself, this is worth prioritising, since a successful chain leads to full server-side code execution rather than just a cosmetic issue.

Confirm all WordPress installs are running 7.0.3 or later (or the appropriate 4.7-branch backport); enable automatic core updates where practical.

Just five days after the XSS2Shell fix, WordPress published a second core security release on 12 August 2026, addressing a separate issue reported responsibly by the pwn.ai research team. WordPress relies on Imagick to process images in the Media Library, and Imagick in turn hands off certain file types, including PostScript and EPS files, to Ghostscript for rendering. Ghostscript has a long history of being tricked into executing unintended commands, and this flaw allows exactly that: a user with an Author-level account or above (specifically, the upload_files capability) can upload a crafted PostScript file disguised as an image and achieve code execution on the server.

On shared hosting, this is patched for you as part of routine updates. On a VPS or dedicated server, the risk depends on whether Author-level or higher accounts are trusted, and whether Ghostscript delegation is actually needed; if it isn’t, disabling it is a sensible extra precaution alongside patching.

Update to WordPress 7.0.4 (or the appropriate 4.7-branch backport) as soon as possible; review whether Ghostscript delegation for Imagick can be disabled where not required.

Wordfence was notified of a compromise on 7 August 2026 and published its analysis the following day. BdThemes, a vendor of Elementor page-builder add-ons distributed through the official WordPress.org plugin directory, ships a shared library called Biggopti that several of its plugins use to pull promotional banners from the vendor’s own API. Attackers gained write access to the object storage bucket behind that API and swapped the legitimate promotional responses for a malicious payload. Critically, no plugin files on affected sites were modified: the attack works entirely through the poisoned feed, which contains a stored cross-site scripting payload that creates a rogue administrator account and drops a PHP web shell every time a logged-in administrator loads wp-admin.

This is one of this week’s more serious issues because it doesn’t require any action from the site owner to trigger, an administrator simply loading their own dashboard is enough to be compromised. On shared hosting, check whether any of your sites use the affected plugins and treat them as compromised if an administrator has logged in since 7 August. On a VPS or dedicated server, the same applies across every WordPress install you manage.

Deactivate any of the seven affected BdThemes plugins immediately; check for unrecognised administrator accounts and unfamiliar PHP files (particularly one named emer-run.php); do not reactivate until BdThemes confirms the feed and plugins are clean.

Microsoft’s August 2026 Patch Tuesday, released on 11 August 2026, addressed just under 400 vulnerabilities, a large release even by recent standards. Four are unauthenticated remote code execution flaws affecting core Windows Server roles: Windows Deployment Services’ TFTP server (CVE-2026-62893), the DHCP server (CVE-2026-62823), the DNS server (CVE-2026-62878, which researchers have described as wormable despite Microsoft’s own “exploitation less likely” rating), and Microsoft’s QUIC implementation used for HTTP/3 (CVE-2026-62815). Alongside these, CVE-2026-68820, a local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys), is already being exploited in the wild as a zero-day; Check Point Research has linked the activity to the North Korea-affiliated Lazarus group’s long-running Operation Dream Job campaign, and CISA added it to its Known Exploited Vulnerabilities catalogue on 11 August.

This affects Windows Server infrastructure specifically, so it’s most relevant if you run Windows-based VPS, dedicated servers, or manage Windows Server roles such as DNS or DHCP directly. Prioritise CVE-2026-68820 given the confirmed active exploitation, then the DNS, QUIC and WDS TFTP flaws given their unauthenticated, network-reachable nature.

Apply the August 2026 cumulative update to all Windows Server hosts as soon as possible; disable Windows Deployment Services TFTP if it isn’t in active use, regardless of patch status.

Disclosed on 6 August 2026 by researcher Hyunwoo Kim, Zapscape is a use-after-free in the shadow memory management unit that KVM uses for x86 virtualisation. Two separate code paths validate a shadow page table root before reclaiming it, rather than after, so KVM can carry on building memory mappings against a root that has already been invalidated elsewhere. On an affected host, a privileged process inside a KVM guest, or even local access to a world-writable /dev/kvm, can use this to escape the guest and gain root on the underlying host. It is the third in the same researcher’s series of KVM escape findings this year, following ITScape and Januscape.

This matters most if you run or provide KVM-based virtual machines, since the whole point of the flaw is escaping a guest to compromise the host it runs on. It’s a background platform-level concern for shared hosting; the direct action is for anyone operating KVM hypervisor infrastructure. This is also the third such KVM escape disclosed in as many months, so if your fleet doesn’t already have live-patching in place, repeated manual reboot cycles are becoming a recurring cost worth addressing.

Apply the AlmaLinux 9 kernel update now; track AlmaLinux 8/10 fixes and KernelCare coverage as they become available; consider live-patching to avoid repeated full-fleet reboots for this class of issue.

Because this week’s WordPress core chain and the BdThemes supply-chain attack can both leave visible signs on a website, it’s worth running through the following checks:

If you have questions about any of the issues covered this week, or you’re not sure whether your website or server is affected, our support team is here to help.

We’re always happy to talk through anything that’s unclear, so don’t hesitate to get in touch.