Not marketing, just the details that matter: configuration, test method and remediation steps.
19 October 2026: 1,105 of 2,080 .tr sites load a vulnerable library version; 455 run a jQuery release on CISA's KEV list. Conditions and fixes.
CVE-2026-87902 in WordPress 4.7–7.1.1 lets an attacker with no account include server files and, on some setups, run code. Exploited since day one. Cause, at-risk themes, checks and patched versions.
AIOS 5.4.9 validates the 2FA code against an account id taken from the login request, not the user whose password passed — a CWE-287 bypass.
We found a similar authentication weakness at three different clients. The problem wasn’t the library but the options it was given. What to watch for, and how to close it.
nginx 0.8.11 to 1.31.6 is affected; 1.30.6 and 1.31.7 fix it (14 October 2026). It only triggers with AIO on and SSI pages using include virtual, both off by default. How to check, patched releases and the stopgap.
PHP 8.2 to 8.5 before 8.2.35, 8.3.36, 8.4.27 and 8.5.12 is affected. Disclosed on 21 October 2026; Cloudflare reports attack traffic. Non-WordPress PHP sites, what Cloudflare does and doesn't stop, version checks and stopgaps.
Linux 6.0 and later plus RHEL, AlmaLinux and Rocky 9–10 are affected; fixes have existed since 2025. CISA added it to KEV on 18 September 2026. How to check for kTLS, patched kernels by distribution and why the reboot matters.
Self-managed GitLab 18.7 to 19.3.1 is affected; 19.3.2 fixes it. Exploited in the wild since 11 September 2026 (CISA KEV). How to check your version, patched releases per branch and which secrets to rotate.
A missing per-capability check in PublishPress Capabilities lets a delegated WordPress manager escalate to administrator. A defensive secure-coding breakdown.
A query-parameter flaw in Admin and Site Enhancements (ASE) lets anyone bypass its hide-login protection and recover the secret login slug.
A front-end AJAX nonce and missing capability checks let unauthenticated visitors read non-public content and low-privilege users write a site-wide option.
A missing-authorization flaw in ElementsKit Lite 4.0.7 lets anonymous visitors render published Elementor templates through a megamenu REST route.
A missing capability check in Essential Blocks for Gutenberg lets any Contributor read the admin's Google Maps API key. Root cause, fix and detection.
A missing capability check in GiveWP's v3 REST API lets anyone read donor names, amounts and dates. A broken-access-control breakdown for defenders.
A loose substring check on the request URI lets any anonymous visitor switch off reCAPTCHA on a 100k-install WordPress plugin. Root cause and fixes.
An unsanitized Mailchimp API-key field in Happy Addons for Elementor 3.50.0 lets a Contributor drive server-side requests. A CWE-918 secure-coding case study.
Login LockDown 2.18 trusts a client-side CAPTCHA token, so one captured answer/token pair replays forever. Root cause, fix, and detection.
Loginizer keys its brute-force lockout on a spoofable client-IP header, so an unauthenticated attacker can bypass the limit. A defensive analysis of CWE-348.
A client-set cookie is trusted as proof of access in the Maintenance plugin (1M+ installs), so any visitor can walk past the coming-soon wall. Root cause and fix.
A cache key built from the raw request URI lets anonymous visitors flood a Page Optimize site with duplicate cache files, exhausting disk and inodes (CWE-770).
Two missing-authorization flaws in Premium Addons for Elementor 4.11.110 let a Contributor publish posts and anonymous visitors read private library templates.
WP Hide & Security Enhancer 2.9.3 completes login without a second factor for users who already set up 2FA, through its default "Set up later" path.
A missing capability check in WPS Hide Login lets any logged-in subscriber overwrite WordPress site transients. Root cause, fix, and defensive guidance.
A nonce-only AJAX action in 301 Redirects 2.85 lets any Subscriber write a site-global WordPress option — a textbook CWE-862 missing-authorization flaw.
A WordPress AJAX handler in ASE skips its capability and nonce checks, so any logged-in Subscriber can turn an attachment ID into a media URL.
A missing authorization check lets any anonymous visitor flip the login-cache admin notice in Limit Login Attempts Reloaded 3.3.10. A CWE-862 case study.
HSTS, CSP, X-Frame-Options and more. What each header blocks, which configurations cause trouble in production, and how to roll them out gradually.
Under KVKK (Turkey’s personal data protection law), breach notification looks like a legal matter, but without logging and detection in place you won’t make the deadline.