{"id":27447,"date":"2026-09-10T09:59:17","date_gmt":"2026-09-10T08:59:17","guid":{"rendered":"https:\/\/www.heartinternet.uk\/blog\/?p=27447"},"modified":"2026-09-10T09:59:17","modified_gmt":"2026-09-10T08:59:17","slug":"weekly-cybersecurity-summary-4-september-to-10-september-2026","status":"publish","type":"post","link":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/","title":{"rendered":"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026"},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_column_text css=”” text_direction=”default”]The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help website owners understand what they mean, who may be affected, and what sensible steps to take. This week’s issues span a critical cPanel and WHM flaw affecting virtually every shared hosting environment, two critical WordPress plugin vulnerabilities, two actively exploited Windows zero-days from September’s record-breaking Patch Tuesday, and a libxml2 security release affecting PHP’s XML processing across all major Linux distributions.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`Critical`}` cPanel & WHM EmailTrack flaw leads to root-level code execution (CVE-2026-67401)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]cPanel’s EmailTrack feature monitors and reviews email delivery activity, including message routing and delivery information, and is present on virtually every cPanel and WHM server. cPanel found that the feature is vulnerable to SQL injection that an authenticated account holder with mail-related privileges can use to create arbitrary files anywhere on the underlying server. Because those files can be placed where they will be executed with root privileges, a low-tier account with nothing more than ordinary mail permissions is enough to take over the entire server. The flaw was disclosed by cPanel on 8 September 2026, with the CVE record published the following day.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

All currently supported versions of cPanel & WHM, where the attacker holds an existing account with mail-related privileges.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

11.110.0.143+, 11.134.0.55+, 11.136.0.39+, 11.138.0.4+ (WP2: 11.138.1.9+).[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

9.9 (Critical).[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]On shared hosting, any account with mail privileges on an unpatched server, however small, could in principle be used to compromise every other website, database and email account on that same machine. On VPS or dedicated servers the risk is limited to that one server, but full compromise should be assumed until it is patched.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Update to the fixed builds above without delay. If your server updates automatically it should already be covered; otherwise force the update through WHM or by running \/scripts\/upcp –force as root.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`Critical`}` Mail Mint unauthenticated PHP object injection leads to remote code execution (CVE-2026-10196)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]Mail Mint is an email marketing and automation plugin for WordPress and WooCommerce, with around 5,000 active installs. Researchers found that its handle_form_submission function deserialises user-supplied input without validating it first, allowing an unauthenticated attacker to inject a specially crafted PHP object. Combined with a gadget chain already present in the plugin’s own code, that object can be used to execute arbitrary code on the server with no login required at all. The issue was disclosed on 5 September 2026.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

Mail Mint (getwpfunnels) versions up to and including 1.31.0.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

Update to the latest available release and confirm the fix in your changelog; an earlier partial patch in version 1.23.1 did not fully close this issue.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

9.8 (Critical) \u2014 network vector, low complexity, no privileges or user interaction required.[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Any website using Mail Mint for email automation should treat this as an urgent update, particularly given how little an attacker needs to exploit it.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Update Mail Mint to the latest version immediately, or remove the plugin if it is not actively in use.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`Critical`}` Hummingbird Performance unauthenticated code injection via debug log (CVE-2026-83627)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]Hummingbird Performance is a caching and page-speed optimisation plugin from WPMU DEV, with more than 100,000 active installs. The plugin writes a debug log to a web-accessible file that is supposed to be protected by a line of PHP that stops the file being executed directly. Researchers found that a coding mistake in how that protection is applied means the guard is never actually written to the log, and because the log also records raw cookie values without sanitising them, an attacker can set a cookie containing PHP code, wait for the plugin to log it, and then request the log file directly to have the server run that code. No login is required at any point. The issue was disclosed on 5 September 2026.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

Hummingbird Performance versions up to and including 3.21.0.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

3.21.1.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

9.8 (Critical) \u2014 network vector, low complexity, no privileges or user interaction required.[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Given the plugin’s large install base, this is one of the more widely relevant WordPress issues this week; any site running an affected version is exposed regardless of hosting type.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Update Hummingbird Performance to 3.21.1 or later immediately, and check the wp-content\/wphb-logs\/ folder for any unfamiliar or recently modified files.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`High`}` Two actively exploited Windows zero-days patched in September’s record Patch Tuesday (CVE-2026-81963, CVE-2026-85880)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]Microsoft’s September 2026 Patch Tuesday, released 8 September, was the largest security update in the company’s history, addressing close to 966 vulnerabilities across Windows, Office, Exchange Server, SQL Server and Azure. Two of the Windows fixes closed local elevation-of-privilege flaws that Microsoft confirmed were already being exploited before patches were available. CVE-2026-81963 is a link-following flaw in the Windows Update Stack that lets an attacker who already has low-privileged code execution on a machine escalate to full SYSTEM access; Microsoft notes this is the first Windows Update Stack zero-day exploited in the wild since 2022. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC), the mechanism Windows processes use to communicate internally, that lets an attacker already running code inside a low-privilege sandboxed AppContainer escape it and reach SYSTEM.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

CVE-2026-81963 affects Windows 11 23H2\/24H2\/25H2\/26H1 and Windows Server 2025 (including Server Core); CVE-2026-85880 affects Windows 10 and Windows Server 2012 through 2022.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

Both resolved in the 8 September 2026 cumulative updates for the relevant Windows versions.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

7.8 (High) for both \u2014 local vector, low privileges required, no user interaction, high impact.[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Both flaws require an attacker to already have some form of code execution on the machine, so they typically follow an initial compromise rather than providing one directly; the fact that both were exploited before a patch existed means any Windows Server host that has not yet applied this month’s update should be treated as potentially at risk.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Apply the September 2026 cumulative update to all Windows Server and Windows 11 hosts without delay, and review for signs of prior compromise if patching has been delayed.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`High`}` libxml2 2.15.4 fixes eight vulnerabilities affecting PHP’s XML processing (CVE-2026-86140 and seven related CVEs)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]libxml2 is the XML parsing library behind PHP’s DOMDocument and SimpleXML extensions, used directly or indirectly by WordPress, Drupal and most other PHP-based platforms. On 6 September 2026, the project shipped version 2.15.4, fixing eight separate memory-safety issues across its parsing, validation and XPointer code. The most severe, CVE-2026-86140, is a stack-based buffer overflow in the xmlSnprintfElements() function caused by an unchecked strcat() call, rated CVSS 8.0. The remaining seven cover an out-of-bounds read during regular-expression parsing, two integer overflows that can lead to heap corruption, a NULL pointer dereference, a heap buffer overflow in XPointer handling, an integer-coercion issue that can reach write callbacks, and a flag-propagation bug in XInclude processing that can enable XXE, SSRF or denial of service.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

libxml2 versions before 2.15.4, underlying PHP’s XML extensions on all our supported Linux distributions.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

2.15.4.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

8.0 (High) for the most severe issue (CVE-2026-86140); CVSS scores for the remaining seven had not been published at the time of writing.[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]This is a platform-level library rather than a flaw in any specific website, so the practical risk depends on how quickly an updated package reaches your server. Hosting providers should prioritise rolling the update out across their PHP stacks.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Update libxml2 to 2.15.4 or later as soon as your distribution’s package is available, and restart PHP-FPM, Apache or Nginx workers afterwards so the new library is loaded.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”How to Check If Your Site Has Been Compromised” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”]

\n
    \n
  • Review your WordPress admin user list for any accounts you don’t recognise, particularly if you run Mail Mint or Hummingbird Performance.<\/li>\n
  • Check for unexpected PHP files in your uploads directory, log folders (such as wp-content\/wphb-logs\/), or theme and plugin folders.<\/li>\n
  • Look at file modification times for anything changed outside of your own update or editing activity.<\/li>\n
  • If you manage your own server, check for unfamiliar cron jobs, SSH keys, new system user accounts, or unexpected files created by mail-privileged cPanel accounts.<\/li>\n
  • If in doubt, a malware scan through your hosting control panel or a security plugin is a sensible first step.<\/li>\n<\/ul>\n <\/div>[\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Frequently Asked Questions” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Do I need to worry about the Windows zero-days if I only host on Linux?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    No. CVE-2026-81963 and CVE-2026-85880 only affect Windows Server and Windows 11. If none of your infrastructure runs Windows, no action is needed for those two items. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Does the libxml2 issue mean my WordPress or Drupal site is vulnerable right now?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    Not necessarily on its own. Most of the eight issues need a particular kind of malicious XML input to reach the vulnerable code, and PHP’s XML extensions aren’t always exposed directly to attacker-controlled input. It is still worth updating promptly given how widely the library is used. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”I don’t use Mail Mint or Hummingbird Performance \u2014 do these affect me?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    No. Both are specific WordPress plugins. If you don’t have them installed, no action is required for those two items. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Why do critical cPanel vulnerabilities keep appearing?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    cPanel has had several critical disclosures this year, reflecting increased researcher and vendor attention on control panel security. We continue to track and report each one as it is disclosed, and recommend keeping automatic updates enabled where possible. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What should I do if I can’t update immediately?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    Where an immediate update isn’t possible, use the temporary steps noted in each section above (for example, restricting mail-account privileges or disabling a specific feature) and prioritise the full update as soon as your maintenance window allows. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Need Help? Get in Touch” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]If you have questions about any of the issues covered in this summary, or need help checking your hosting environment, you can raise a support ticket via the Customer Area at heartinternet.uk, or chat with our live support team Monday to Friday, 09:30\u201316:00. You can also browse our knowledge base at heartinternet.uk\/support for step-by-step guides.<\/p>\n

    We’re here to help keep your website secure.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"

    [vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″…<\/p>\n","protected":false},"author":81,"featured_media":25880,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-27447","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security"],"yoast_head":"\nWeekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Heart Internet<\/title>\n<meta name=\"description\" content=\"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Written by the team at Heart Internet.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Heart Internet\" \/>\n<meta property=\"og:description\" content=\"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Written by the team at Heart Internet.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"Heart Internet\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/heartinternet\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-10T08:59:17+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"1000\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Si\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@heartinternet\" \/>\n<meta name=\"twitter:site\" content=\"@heartinternet\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Si\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/\"},\"author\":{\"name\":\"Si\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/person\/9e254878008ecf928e1cbe176faac34c\"},\"headline\":\"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026\",\"datePublished\":\"2026-09-10T08:59:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/\"},\"wordCount\":9732,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp\",\"articleSection\":[\"Security\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/\",\"name\":\"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Heart Internet\",\"isPartOf\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp\",\"datePublished\":\"2026-09-10T08:59:17+00:00\",\"description\":\"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Written by the team at Heart Internet.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#primaryimage\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp\",\"contentUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp\",\"width\":1000,\"height\":1000},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.heartinternet.uk\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/heartblog.victory.digital\/#website\",\"url\":\"https:\/\/heartblog.victory.digital\/\",\"name\":\"Heart Internet\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/heartblog.victory.digital\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/heartblog.victory.digital\/#organization\",\"name\":\"Heart Internet\",\"url\":\"https:\/\/heartblog.victory.digital\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp\",\"contentUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp\",\"width\":992,\"height\":252,\"caption\":\"Heart Internet\"},\"image\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/heartinternet\/\",\"https:\/\/x.com\/heartinternet\",\"https:\/\/www.linkedin.com\/company\/heart-internet-ltd\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/person\/9e254878008ecf928e1cbe176faac34c\",\"name\":\"Si\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/07\/cropped-Screenshot-2026-07-31-132538-96x96.png\",\"contentUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/07\/cropped-Screenshot-2026-07-31-132538-96x96.png\",\"caption\":\"Si\"},\"sameAs\":[\"https:\/\/www.heartinternet.uk\/\"],\"url\":\"https:\/\/www.heartinternet.uk\/blog\/author\/simon\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Heart Internet","description":"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Written by the team at Heart Internet.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/","og_locale":"en_GB","og_type":"article","og_title":"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Heart Internet","og_description":"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Written by the team at Heart Internet.","og_url":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/","og_site_name":"Heart Internet","article_publisher":"https:\/\/www.facebook.com\/heartinternet\/","article_published_time":"2026-09-10T08:59:17+00:00","og_image":[{"width":1000,"height":1000,"url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp","type":"image\/webp"}],"author":"Si","twitter_card":"summary_large_image","twitter_creator":"@heartinternet","twitter_site":"@heartinternet","twitter_misc":{"Written by":"Si","Estimated reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#article","isPartOf":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/"},"author":{"name":"Si","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/person\/9e254878008ecf928e1cbe176faac34c"},"headline":"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026","datePublished":"2026-09-10T08:59:17+00:00","mainEntityOfPage":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/"},"wordCount":9732,"commentCount":0,"publisher":{"@id":"https:\/\/heartblog.victory.digital\/#organization"},"image":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp","articleSection":["Security"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/","url":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/","name":"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Heart Internet","isPartOf":{"@id":"https:\/\/heartblog.victory.digital\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#primaryimage"},"image":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp","datePublished":"2026-09-10T08:59:17+00:00","description":"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026 - Written by the team at Heart Internet.","breadcrumb":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#primaryimage","url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp","contentUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/08\/placeholder.webp","width":1000,"height":1000},{"@type":"BreadcrumbList","@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-4-september-to-10-september-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.heartinternet.uk\/blog\/"},{"@type":"ListItem","position":2,"name":"Weekly Cybersecurity Summary \u2014 4 September to 10 September 2026"}]},{"@type":"WebSite","@id":"https:\/\/heartblog.victory.digital\/#website","url":"https:\/\/heartblog.victory.digital\/","name":"Heart Internet","description":"","publisher":{"@id":"https:\/\/heartblog.victory.digital\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/heartblog.victory.digital\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/heartblog.victory.digital\/#organization","name":"Heart Internet","url":"https:\/\/heartblog.victory.digital\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/","url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp","contentUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp","width":992,"height":252,"caption":"Heart Internet"},"image":{"@id":"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/heartinternet\/","https:\/\/x.com\/heartinternet","https:\/\/www.linkedin.com\/company\/heart-internet-ltd"]},{"@type":"Person","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/person\/9e254878008ecf928e1cbe176faac34c","name":"Si","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/person\/image\/","url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/07\/cropped-Screenshot-2026-07-31-132538-96x96.png","contentUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/07\/cropped-Screenshot-2026-07-31-132538-96x96.png","caption":"Si"},"sameAs":["https:\/\/www.heartinternet.uk\/"],"url":"https:\/\/www.heartinternet.uk\/blog\/author\/simon\/"}]}},"_links":{"self":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/27447","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/users\/81"}],"replies":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/comments?post=27447"}],"version-history":[{"count":5,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/27447\/revisions"}],"predecessor-version":[{"id":27453,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/27447\/revisions\/27453"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/media\/25880"}],"wp:attachment":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/media?parent=27447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/categories?post=27447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/tags?post=27447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}