Blesta: Not Everything Should Be Vibe Coded. Apparently, Security Reports Can Be Vibe Ignored.
A WHMCS refugee, two AI assistants, 32 security findings, twelve matching code fixes, and a support ticket that has apparently taken a vow of silence.
CVE
PHP2Shell Day: Everyone Else Took Their Sites Offline. We Merged a WAF Rule.
Two critical PHP RCEs, a leaked embargo, a continent of nervous sysadmins, and one daemon that spent the afternoon arguing with its own code reviews. What CFM rules 10021/10022 catch for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — and what they don’t.
GhostLock (CVE-2026-43499): “no mitigation” is true for the bug — not for the exploit chain
CloudLinux says GhostLock has no mitigation. That’s true for the kernel UAF — but not for the public exploit chain. Here’s what CFM already ships against two of its stages, and, just as importantly, what it doesn’t.
CVE-2026-41940: The 64-Day Backdoor Into the Internet’s Control Plane
A critical authentication bypass in cPanel & WHM gave attackers root access to over a million publicly exposed servers — silently, without a password, defeating two-factor authentication — for sixty-four days before anyone patched a thing. What Was Actually at Stake cPanel and WHM are not just web applications. They are the administrative nervous system … Read more