{"id":27528,"date":"2026-09-17T12:04:01","date_gmt":"2026-09-17T11:04:01","guid":{"rendered":"https:\/\/www.heartinternet.uk\/blog\/?p=27528"},"modified":"2026-09-17T12:04:01","modified_gmt":"2026-09-17T11:04:01","slug":"weekly-cybersecurity-summary-11-september-to-17-september-2026","status":"publish","type":"post","link":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/","title":{"rendered":"Weekly Cybersecurity Summary – 11 September to 17 September 2026"},"content":{"rendered":"[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_column_text css=”” text_direction=”default”]The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help customers understand what they mean, who may be affected, and what sensible steps to take. This week we’re covering four issues: two critical command injection flaws in a firewall tool used on a large share of cPanel\/WHM servers, an account-isolation bypass in LiteSpeed Web Server Enterprise, an actively exploited backup-plugin flaw affecting cPanel\/WHM and Plesk deployments, and a newly disclosed WordPress plugin vulnerability that allows unauthenticated administrator account takeover.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`Critical`}` ConfigServer Security & Firewall Remote Command Injection Flaws (CVE-2026-65638, CVE-2026-65639)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]ConfigServer Security & Firewall, commonly known as CSF, is a firewall and intrusion detection suite used on a large proportion of cPanel and WHM servers. On 10 September 2026, researchers disclosed two separate command injection vulnerabilities in CSF. The first, CVE-2026-65638, lies in CSF’s MESSENGER service, a feature that displays a message to visitors who have been blocked by the firewall; it fails to properly escape part of the request URL before passing it to a shell command, so an unauthenticated attacker can inject and run arbitrary commands. It only applies when MESSENGER and a reCAPTCHA secret are both configured, which is not the default setup. The second, CVE-2026-65639, sits in CSF’s advanced-rule parser: if an attacker can control a configured allow or deny feed, insufficient validation of the feed data lets them run arbitrary commands as root.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

CSF versions 14.00 to 16.29 (CVE-2026-65638) and versions 2.15 to 16.29 (CVE-2026-65639), including the WebPros-maintained fork.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

16.30 and later.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

9.2 (CVE-2026-65638), 9.5 (CVE-2026-65639).[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]On shared hosting, a successful attack against a server-wide firewall tool like CSF could affect every website on that server, not just one account, since the compromise happens at root level. On VPS and dedicated servers, the practical risk is lower unless MESSENGER with reCAPTCHA is deliberately configured, or the server pulls IP block lists from a feed an attacker could influence, but the potential impact if either applies is severe.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Update CSF to 16.30 or later on any server where it is installed. If MESSENGER is enabled, disable it until the update is confirmed applied.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`High`}` LiteSpeed Web Server Enterprise Account-Isolation Bypass (no CVE assigned)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]cPanel published an advisory on 14 September 2026 warning that LiteSpeed Web Server Enterprise, widely used as a faster alternative to Apache on shared hosting, contains a flaw that lets a malicious low-privilege hosting account escape the isolation controls meant to keep customer accounts separate, including CageFS, and potentially reach root on the underlying server. Neither cPanel nor LiteSpeed have published technical detail on how the flaw works, and as of publication no CVE identifier has been assigned to it, which is unusual for an issue of this severity. This is reportedly the third LiteSpeed account-isolation flaw disclosed in four months.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

LiteSpeed Web Server Enterprise before version 6.3.7.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

6.3.7.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

Not assigned.[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]This is specifically a shared-hosting risk, since it depends on multiple customer accounts sharing one server, which is exactly the CageFS model. VPS and dedicated server users, where each customer already has their own isolated environment, are not affected by this particular flaw.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Update LiteSpeed Web Server Enterprise to 6.3.7 or later on every affected server as a priority.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`High`}` Acronis Backup Plugin for cPanel & WHM and Plesk Actively Exploited (CVE-2026-87886)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]Acronis disclosed on 15 September 2026 that its Backup plugin for cPanel & WHM and its Backup extension for Plesk contain a local privilege escalation flaw caused by incorrect default file permissions. Acronis confirmed that exploitation has already been detected in the wild, in limited and targeted attacks against cPanel & WHM deployments; no exploitation against Plesk deployments has been reported so far. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 16 September 2026.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

Acronis Backup plugin for cPanel & WHM before build 1.9.3.1021, and Backup extension for Plesk before build 1.8.11.638.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

1.9.3 HF3 (cPanel & WHM), 1.8.11 (Plesk).[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

7.8.[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Exploitation requires an attacker to already have some form of local, low-privilege access to the server, for example through a compromised hosting account, weak credentials, or a vulnerable web application. From there, this flaw could let them escalate to read backup data, system files, or other accounts on a shared server.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Update the Acronis Backup plugin\/extension to the fixed build on any server where it is installed, and review access logs for signs of unexpected privilege changes.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”`{`Critical`}` WordPress “Login with QR“ Plugin Unauthenticated Admin Takeover (CVE-2026-86710)” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]A vulnerability disclosed on 17 September 2026 in the WordPress plugin “Login with QR” (versions up to and including 1.0.0) allows any unauthenticated visitor to log in as any user on the site, including administrators. The plugin is meant to let a user log in by scanning a QR code, but it fails to verify that the code presented is one it actually issued, instead accepting any code that matches a stored value, which an attacker can guess or generate themselves. No fixed version has been published yet.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-exclamation-triangle” icon_size=”20″ min_height=”120″]\n

Affected: <\/strong><\/h4>\n

Login with QR, all versions up to 1.0.0.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-check” icon_size=”20″ min_height=”120″]\n

Fixed version: <\/strong><\/h4>\n

None yet available.[\/fancy_box][\/vc_column_inner][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/3″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][fancy_box box_style=”color_box_hover” icon_family=”fontawesome” color=”accent-color” color_box_hover_overlay_opacity=”default” box_alignment=”center” enable_border=”true” border_radius=”default” image_loading=”default” icon_fontawesome=”fa fa-star” icon_size=”20″ min_height=”120″]\n

CVSS: <\/strong><\/h4>\n

Not yet scored by NVD.[\/fancy_box][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What This Means For You:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]If a website owner has this plugin installed and active, an attacker could gain full administrative control of that WordPress site without needing any credentials.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Recommended Action:” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]Deactivate and remove the plugin immediately on any site where it is installed, until a fixed version is released.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”How to Check If Your Site Has Been Compromised” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”]

\n
    \n
  • Review the WordPress admin users list for accounts you don’t recognise, particularly any created or elevated to Administrator recently.<\/li>\n
  • Check for unexpected changes to plugin or theme files, or new files in the uploads directory.<\/li>\n
  • Review cPanel\/WHM account and server access logs around the affected dates for unusual privilege escalations or process activity.<\/li>\n
  • Check for unfamiliar cron jobs or scheduled tasks.<\/li>\n
  • Look for outbound connections to unfamiliar IP addresses or domains from the server.<\/li>\n
  • If you find anything suspicious, change all passwords and API keys, and consider taking the affected site offline while you investigate further.<\/li>\n<\/ul>\n <\/div>[\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Frequently Asked Questions” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Do I need to do anything if I don’t use CSF, LiteSpeed, or Acronis Backup?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    If your server doesn’t run these specific products, these particular flaws don’t apply to you, but it’s still worth checking which control panel add-ons and backup tools are installed, since these products are common defaults on many cPanel\/WHM servers. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Is my site at risk if I’m on shared hosting versus a VPS?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    The CSF and LiteSpeed issues are most severe on shared hosting, where one compromised account could affect the whole server. VPS and dedicated server customers, where isolation already exists at the virtual machine level, face a narrower risk from these two issues, though the Acronis and WordPress plugin flaws can affect any hosting type. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”How urgently should I patch these?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    The CSF and Acronis issues are already being exploited or are trivially exploitable, so these should be treated as priorities. The LiteSpeed issue has no confirmed public exploitation yet but affects the core hosting isolation model, so it should also be addressed promptly. The WordPress plugin issue should be dealt with immediately if that specific plugin is in use, since exploitation requires no special access. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Why doesn’t the LiteSpeed flaw have a CVE number yet?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    CVE assignment can lag behind vendor advisories, particularly when a vendor chooses not to publish technical detail about how a flaw works. The absence of a CVE doesn’t reduce the severity of the issue; the fixed version should still be applied as a priority. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”What should I do if I can’t immediately update one of these products?” text_direction=”default”][\/split_line_heading]
    <\/i> <\/div>
    Where an immediate update isn’t possible, consider temporary mitigations: disabling the vulnerable feature (for example, CSF’s MESSENGER service), restricting access, or, for CageFS-dependent servers, closely monitoring for unusual account activity until the update can be applied. <\/div>
    <\/div><\/div>[\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Summary” text_direction=”default”][\/split_line_heading][vc_column_text css=”” text_direction=”default”]\n\n\n\n\n\n\n\n\n
    Vulnerability<\/strong><\/td>\nCVE<\/strong><\/td>\nCVSS<\/strong><\/td>\nAffected<\/strong><\/td>\nFixed<\/strong><\/td>\nAction<\/strong><\/td>\n<\/tr>\n
    ConfigServer Firewall MESSENGER command injection<\/td>\nCVE-2026-65638<\/td>\n9.2<\/td>\nCSF 14.00-16.29<\/td>\n16.30+<\/td>\nUpdate CSF<\/td>\n<\/tr>\n
    ConfigServer Firewall advanced-rule parser command injection<\/td>\nCVE-2026-65639<\/td>\n9.5<\/td>\nCSF 2.15-16.29<\/td>\n16.30+<\/td>\nUpdate CSF<\/td>\n<\/tr>\n
    LiteSpeed Enterprise CageFS bypass<\/td>\nNone assigned<\/td>\nN\/A<\/td>\nLiteSpeed Enterprise <6.3.7<\/td>\n6.3.7<\/td>\nUpdate LiteSpeed<\/td>\n<\/tr>\n
    Acronis Backup plugin\/extension local privilege escalation<\/td>\nCVE-2026-87886<\/td>\n7.8<\/td>\ncPanel\/WHM <1.9.3.1021, Plesk <1.8.11.638<\/td>\n1.9.3 HF3 \/ 1.8.11<\/td>\nUpdate Acronis plugin<\/td>\n<\/tr>\n
    Login with QR unauthenticated admin takeover<\/td>\nCVE-2026-86710<\/td>\nPending<\/td>\n<=1.0.0<\/td>\nNone yet<\/td>\nDeactivate plugin<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” top_padding=”3%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” column_position=”default” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][vc_row_inner column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” text_align=”left” row_position=”default” row_position_tablet=”inherit” row_position_phone=”inherit” overflow=”visible” pointer_events=”all”][vc_column_inner column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″ background_hover_color_opacity=”1″ column_backdrop_filter=”none” column_shadow=”none” column_border_radius=”none” column_link_target=”_self” overflow=”visible” gradient_direction=”left_to_right” overlay_strength=”0.3″ width=”1\/1″ tablet_width_inherit=”default” animation_type=”default” bg_image_animation=”none” border_type=”simple” column_border_width=”none” column_border_style=”solid”][split_line_heading animation_type=”line-reveal-by-space” font_style=”h3″ line_reveal_by_space_text_effect=”none” content_alignment=”default” mobile_content_alignment=”inherit” link_target=”_self” text_content=”Need Help? Get in Touch” text_direction=”default”][\/split_line_heading][divider line_type=”Full Width Line” line_thickness=”3″ divider_color=”default”][vc_column_text css=”” text_direction=”default”]If you have any questions about these issues or need help checking your account, please raise a support ticket via the Customer Area at heartinternet.uk, or use live chat, available Monday to Friday, 09:30 to 16:00. You can also find more guidance in our knowledge base at heartinternet.uk\/support. We’re here to help if you’re not sure whether any of this affects you.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"

    [vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” bottom_padding=”2%” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none” gradient_type=”default” shape_type=””][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default” phone_text_alignment=”default” background_color_opacity=”1″…<\/p>\n","protected":false},"author":81,"featured_media":27531,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-27528","post","type-post","status-publish","format-standard","has-post-thumbnail","category-security"],"yoast_head":"\nWeekly Cybersecurity Summary - 11 September to 17 September 2026 - Heart Internet<\/title>\n<meta name=\"description\" content=\"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Written by the team at Heart Internet.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Heart Internet\" \/>\n<meta property=\"og:description\" content=\"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Written by the team at Heart Internet.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/\" \/>\n<meta property=\"og:site_name\" content=\"Heart Internet\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/heartinternet\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-17T11:04:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"2000\" \/>\n\t<meta property=\"og:image:height\" content=\"1181\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Si\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@heartinternet\" \/>\n<meta name=\"twitter:site\" content=\"@heartinternet\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Si\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/\"},\"author\":{\"name\":\"Si\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/person\/9e254878008ecf928e1cbe176faac34c\"},\"headline\":\"Weekly Cybersecurity Summary – 11 September to 17 September 2026\",\"datePublished\":\"2026-09-17T11:04:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/\"},\"wordCount\":8562,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp\",\"articleSection\":[\"Security\"],\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/\",\"name\":\"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Heart Internet\",\"isPartOf\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp\",\"datePublished\":\"2026-09-17T11:04:01+00:00\",\"description\":\"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Written by the team at Heart Internet.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#primaryimage\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp\",\"contentUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp\",\"width\":2000,\"height\":1181},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.heartinternet.uk\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Weekly Cybersecurity Summary – 11 September to 17 September 2026\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/heartblog.victory.digital\/#website\",\"url\":\"https:\/\/heartblog.victory.digital\/\",\"name\":\"Heart Internet\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/heartblog.victory.digital\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/heartblog.victory.digital\/#organization\",\"name\":\"Heart Internet\",\"url\":\"https:\/\/heartblog.victory.digital\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp\",\"contentUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp\",\"width\":992,\"height\":252,\"caption\":\"Heart Internet\"},\"image\":{\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/heartinternet\/\",\"https:\/\/x.com\/heartinternet\",\"https:\/\/www.linkedin.com\/company\/heart-internet-ltd\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/person\/9e254878008ecf928e1cbe176faac34c\",\"name\":\"Si\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/heartblog.victory.digital\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/07\/cropped-Screenshot-2026-07-31-132538-96x96.png\",\"contentUrl\":\"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/07\/cropped-Screenshot-2026-07-31-132538-96x96.png\",\"caption\":\"Si\"},\"sameAs\":[\"https:\/\/www.heartinternet.uk\/\"],\"url\":\"https:\/\/www.heartinternet.uk\/blog\/author\/simon\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Heart Internet","description":"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Written by the team at Heart Internet.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/","og_locale":"en_GB","og_type":"article","og_title":"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Heart Internet","og_description":"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Written by the team at Heart Internet.","og_url":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/","og_site_name":"Heart Internet","article_publisher":"https:\/\/www.facebook.com\/heartinternet\/","article_published_time":"2026-09-17T11:04:01+00:00","og_image":[{"width":2000,"height":1181,"url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp","type":"image\/webp"}],"author":"Si","twitter_card":"summary_large_image","twitter_creator":"@heartinternet","twitter_site":"@heartinternet","twitter_misc":{"Written by":"Si","Estimated reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#article","isPartOf":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/"},"author":{"name":"Si","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/person\/9e254878008ecf928e1cbe176faac34c"},"headline":"Weekly Cybersecurity Summary – 11 September to 17 September 2026","datePublished":"2026-09-17T11:04:01+00:00","mainEntityOfPage":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/"},"wordCount":8562,"commentCount":0,"publisher":{"@id":"https:\/\/heartblog.victory.digital\/#organization"},"image":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp","articleSection":["Security"],"inLanguage":"en-GB","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/","url":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/","name":"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Heart Internet","isPartOf":{"@id":"https:\/\/heartblog.victory.digital\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#primaryimage"},"image":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#primaryimage"},"thumbnailUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp","datePublished":"2026-09-17T11:04:01+00:00","description":"Weekly Cybersecurity Summary - 11 September to 17 September 2026 - Written by the team at Heart Internet.","breadcrumb":{"@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#primaryimage","url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp","contentUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/09\/cybersecurity-1.webp","width":2000,"height":1181},{"@type":"BreadcrumbList","@id":"https:\/\/www.heartinternet.uk\/blog\/weekly-cybersecurity-summary-11-september-to-17-september-2026\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.heartinternet.uk\/blog\/"},{"@type":"ListItem","position":2,"name":"Weekly Cybersecurity Summary – 11 September to 17 September 2026"}]},{"@type":"WebSite","@id":"https:\/\/heartblog.victory.digital\/#website","url":"https:\/\/heartblog.victory.digital\/","name":"Heart Internet","description":"","publisher":{"@id":"https:\/\/heartblog.victory.digital\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/heartblog.victory.digital\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/heartblog.victory.digital\/#organization","name":"Heart Internet","url":"https:\/\/heartblog.victory.digital\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/","url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp","contentUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2025\/02\/HeartInternet_Logo_Colour.webp","width":992,"height":252,"caption":"Heart Internet"},"image":{"@id":"https:\/\/heartblog.victory.digital\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/heartinternet\/","https:\/\/x.com\/heartinternet","https:\/\/www.linkedin.com\/company\/heart-internet-ltd"]},{"@type":"Person","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/person\/9e254878008ecf928e1cbe176faac34c","name":"Si","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/heartblog.victory.digital\/#\/schema\/person\/image\/","url":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/07\/cropped-Screenshot-2026-07-31-132538-96x96.png","contentUrl":"https:\/\/www.heartinternet.uk\/blog\/wp-content\/uploads\/2026\/07\/cropped-Screenshot-2026-07-31-132538-96x96.png","caption":"Si"},"sameAs":["https:\/\/www.heartinternet.uk\/"],"url":"https:\/\/www.heartinternet.uk\/blog\/author\/simon\/"}]}},"_links":{"self":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/27528","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/users\/81"}],"replies":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/comments?post=27528"}],"version-history":[{"count":4,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/27528\/revisions"}],"predecessor-version":[{"id":27540,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/posts\/27528\/revisions\/27540"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/media\/27531"}],"wp:attachment":[{"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/media?parent=27528"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/categories?post=27528"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.heartinternet.uk\/blog\/wp-json\/wp\/v2\/tags?post=27528"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}