Security advisories
Security advisories for Grand Strand businesses.
When a serious flaw shows up in software that local websites run on, we write up what happened, which businesses around here are exposed, and what to ask your host. Each one links to the vendor’s own announcement.
- Critical Online stores · October 28, 2026If your online store runs Magento, the July security patch is no longer optionalCVE-2026-48356 lets an attacker upload a dangerous file to an Adobe Commerce or Magento Open Source store and run code with it. Adobe fixed it in July. On October 27, CISA added it to its list of flaws attackers are actively using, which means stores that skipped the July patch are now being hit.
- Critical Websites & servers · October 28, 2026A flaw in Brotli, the compression behind fast websites, is on CISA’s exploited listBrotli is the compression format most of the web uses to make pages load faster. CVE-2026-111497 is a buffer overflow in its decoder: a crafted compressed stream can corrupt memory and possibly run an attacker’s code. Node.js shipped fixes on October 21, and CISA added the flaw to its exploited list on October 27.
- Critical Email · October 28, 2026Cisco’s email security gateway can be taken over by a single emailCVE-2026-76519 is in the malware-scanning feature of Cisco Secure Email Gateway, the box many companies put in front of their mail to catch bad attachments. A crafted attachment, sent by anyone, can write files and run commands as root on the gateway. Cisco scores it 9.8, and CISA added it to its exploited list on October 14.
- High Devices · October 28, 2026Running Plex at the bar, the office or home? Update to 1.43.3CISA added four Plex Media Server flaws to its exploited list on October 20. Chained together, they let an attacker go from reaching the server to running their own code on the computer it sits on. Every one is fixed in Plex Media Server 1.43.3.10861.
- Critical IT providers · October 28, 2026If an IT provider backs up your files with Ahsay, ask whether this is patchedAhsayCBS is backup server software that many IT providers use to run backups for their clients. Two flaws, chained, let an attacker skip the login and run commands on the backup server. The first patch didn’t fully fix them. CISA added both to its exploited list on October 14.
- High Vulnerabilities · October 26, 2026WP Rocket has three flaws a stranger can reach without logging in. Update to 3.23.5.WP Rocket is one of the most popular paid caching plugins for WordPress. Versions before 3.23.5 carry three published flaws that need no login, including a stored cross-site scripting bug fixed back in April. Because WP Rocket stops updating the moment its license expires, plenty of sites are still running the old versions.
- High Email · October 24, 2026Candidates and campaigns: lock down your email before Election DaySupporters, donors and volunteers trust email from a campaign. If the campaign’s domain doesn’t publish an enforced DMARC policy, anyone can send mail that looks exactly like it came from you, and most inboxes will deliver it. With Election Day on November 3, it’s a fix worth making this week.
- High Vulnerabilities · October 24, 2026Old jQuery is on CISA’s exploited list. Here’s how to check your website.jQuery is the JavaScript library behind a huge share of small-business websites. Every version before 3.5.0 carries CVE-2020-11023, a cross-site scripting flaw CISA added to its Known Exploited Vulnerabilities catalog in January 2025. It was fixed in 2020, but sites built on old themes and discontinued builders still load the old versions.
- Critical IT providers · October 24, 2026Three tools IT companies use to reach your computers are on CISA’s exploited list. Ask yours if they’re patched.If an outside IT company manages your office computers, it almost certainly uses a remote-support or management tool to do it. Flaws in three widely used ones, ConnectWise ScreenConnect, BeyondTrust Remote Support and N-able N-central, were added to CISA’s Known Exploited Vulnerabilities catalog in September and October. The cloud versions were patched by the vendors. Self-hosted ones are up to your provider.
- Critical WordPress · October 24, 202641 premium WordPress themes have a critical flaw, and no fix has been publishedOn October 10 and October 23, the National Vulnerability Database published PHP object injection flaws in 41 premium WordPress themes, nearly all from ThemeREX and AxiomThemes. None needs a login, 40 are rated 9.8, and no fixed version has been published for any of them. If your site runs one, updating isn’t an option yet.
- Critical WordPress · October 24, 2026Critical flaws in eight WordPress booking, checkout and CRM plugins. All have updates.Between October 13 and 20, critical flaws were published in Amelia, LatePoint, SureCart, OttoKit, FluentCRM, The Grid, WP Mailster and Ajax Search Lite. Most need no login, and several of these plugins hold exactly what a business can’t afford to leak: customer names, appointments and orders.
- High Devices · October 24, 2026Three Windows flaws are being used in attacks. Here’s the update that fixes them.Microsoft fixed one in October and two in September, and all three are on CISA’s Known Exploited Vulnerabilities list. The October one lets a booby-trapped attachment or link skip the warning Windows shows for files from the internet. If your office PCs install updates on their own, check that they actually did.
- High Devices · October 24, 2026Apple fixed an image flaw used in targeted attacks. Update iPhones, iPads and Macs.CVE-2026-86950 is in CoreGraphics, the part of iOS and macOS that draws images and documents. Opening a crafted file can run an attacker’s code. Apple says it may have been exploited in an extremely sophisticated attack against specific people, and CISA added it to its exploited list the next day.
- High Hosting · October 24, 2026If your web host backs up with Acronis, ask whether this is patchedCVE-2026-87886 is in the Acronis Backup plugin for cPanel & WHM and the extension for Plesk, two of the most widely used hosting control panels. Insecure file permissions let someone with a basic account on the server take over the whole server. CISA added it to its exploited list on September 16.
- Critical Vulnerabilities · October 22, 2026PHP2Shell is being exploited: CISA added both PHP flaws to its list on October 26. Here’s what to do today.On October 21 the PHP project shipped emergency releases for two flaws that can let a stranger run code on a web server without logging in. On October 26 CISA added both to its catalog of vulnerabilities being used in attacks, as the “PHP Memory Corruption Vulnerability” and the “PHP Stale Internal Request-State Vulnerability.” PHP runs WordPress and most shared hosting, so this reaches a lot of local business sites.
- Critical Supply chain · October 22, 2026Rank Math SEO PRO shipped with malware for 11 hours. Here’s who needs to act.Some copies of Rank Math SEO PRO 3.0.123 downloaded or updated between 4:02 PM on October 15 and 3:12 AM on October 16 (Eastern) contained malware. Rank Math says any site that activated one of those copies should be treated as hacked. The free version from WordPress.org is not affected.
- Critical Vulnerabilities · October 22, 2026A flaw in WordPress itself is being exploited. Here’s how to check your site.On September 22 WordPress released a security fix for every version back to 4.7. Attackers started testing sites within hours, and on September 25 CISA added the flaw to its list of vulnerabilities being used in real attacks. Any WordPress site that hasn’t updated since is a target.
- Critical Vulnerabilities · October 22, 2026Elementor Pro 4.2.1 and older let strangers upload files through your formsA critical flaw in Elementor Pro’s form widget lets anyone upload a file to the server without logging in, if the form has a file-upload field. It was fixed in August, but we keep finding older Elementor Pro on Grand Strand business sites.
- High Network · October 22, 2026Is your office firewall or router on CISA’s exploited list?Since August, CISA has added 25 flaws in firewalls, routers, switches and remote-access boxes to its list of vulnerabilities being used in real attacks. Fortinet, SonicWall, MikroTik, Zyxel and Cisco are all on it, and these are the boxes small offices install once and never touch again.
- Critical Monthly roundup · October 22, 2026October’s critical WordPress plugin flaws, and the ones a small business is likely to runFrom October 1 to 22, our database recorded 900 new WordPress plugin and theme vulnerabilities. 59 of them are rated critical. Here are the ones in plugins local business sites actually use: forms, popups, calendars, stores and photo galleries.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Get in touch
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
Not ready to talk yet? Run the free website check and see what Google sees.