Today’s CVE drop: a dozen vulnerabilities in vm2, the popular Node.js sandbox library, with three of them at CVSS 9.8 — full sandbox escape, arbitrary code execution on the host. CVE-2026-24118 leverages JavaScript’s __lookupGetter__ to break out. CVE-2026-24120 bypasses …
Apple shipped iOS 26.3 yesterday with 38 security fixes, one of which was the first actively exploited zero-day of 2026: CVE-2026-20700, a memory-corruption bug in dyld — Apple’s dynamic linker, the very piece of code that loads every other …
One of the most common WordPress malware patterns I’ve cleaned in the last two years isn’t a webshell or a credential stealer — it’s a “fake plugin” or “fake theme.” The attacker creates a directory in wp-content/plugins/ or wp-content/themes/ with …
The default state of 22/tcp on a public IP is “constantly probed by every botnet on the planet.” Even with key-only auth and fail2ban, the noise floor of failed SSH attempts is real — my auth.log picks up 3,000–5,000 hostile …
You have a private server in a VPC that’s only reachable through a bastion host. The “obvious” way to SSH there is the wrong way: copy your private key onto the bastion, then SSH from bastion to the private box. …
Last quarter I had a long-running bash daemon that needed to start as root (to bind a privileged port and read a key file in /etc) and then immediately drop to an unprivileged user before doing anything else. The …
If a WordPress site of yours has been compromised — even briefly, even silently — there’s a very good chance it now has at least one administrator account that you didn’t create. Most WP malware families plant one as part …
Every WordPress site running with default config is being hammered right now by brute-force scripts hitting xmlrpc.php and wp-login.php. If you run multiple sites on a single OpenLiteSpeed (LSWS) box, dropping a per-site .htaccess rule on each one is …
If you run more than one WordPress site on a single server and every wp-config.php has DB_USER = 'root', your eight sites are effectively one site as far as a compromise is concerned. One vulnerable plugin on any of …
Open /var/log/auth.log on a public-facing server and you’ll see thousands of lines per day — failed logins, accepted logins, sudo events, cron registrations. The signal you usually care about (who’s brute-forcing me, from where, against which users?) is buried in …