GitHub Security Advisories · GITHUB GHSA-2phh-27fw-q4gc + CVE-2026-108360 VERIFIED
£12 WordPress & WooCommerce Security Shield Pack
## Summary PhpSpreadsheet's `Worksheet\Drawing::setPath()` validates an external-image URL against an operator-supplied `isWhitelisted` callback **once**, on the initial URL only, then fetches it with `file_get_contents()` using a stream co
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
GitHub Security Advisories · GITHUB GHSA-r925-mgvr-h9cc + CVE-2026-108082 VERIFIED
£12 WordPress & WooCommerce Security Shield Pack
### Description `HeaderUtils::split()` parsed header values with a pattern whose token alternative also matched whitespace, followed by a `(?<!\s)` lookbehind. A run of whitespace placed before a separator could be divided among the iterati
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
GitHub Security Advisories · GITHUB GHSA-2v3c-qxhr-7vpv + CVE-2026-109413 VERIFIED
£12 WordPress & WooCommerce Security Shield Pack
### Description `Yaml\Parser::lexInlineStructure()` recursed through `lexInlineMapping()` and `lexInlineSequence()` for every `{` and `[` of an inline collection, without entering the nesting level that the rest of the parser bounds with `m
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
GitHub Security Advisories · GITHUB GHSA-mf2p-h6hf-fcwm + CVE-2026-116675 VERIFIED
£12 WordPress & WooCommerce Security Shield Pack
### Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with th
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
The Hacker News · VERIFIED 6-FEED SECURITY RADAR
£12 WordPress & WooCommerce Security Shield Pack
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access. "First identified in late 2023, Silent Train u
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
The Hacker News · VERIFIED 6-FEED SECURITY RADAR
£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack
Third-party Android app stores can now apply to Google for permission to install apps with one tap, without Android's usual confirmation screens, and to update them in the background. To qualify, a store must pass identity checks and send Google its full
Drop-In UK Remediation: Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding.
The Hacker News · VERIFIED 6-FEED SECURITY RADAR
£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack
A chain of logic flaws, with no memory corruption, can turn a malicious web page into code running on a Windows computer outside Microsoft Edge's sandbox, a security researcher has shown. Orange Tsai of DEVCORE published the full method on October 28, five mon
Drop-In UK Remediation: Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding.
The Hacker News · VERIFIED 6-FEED SECURITY RADAR
£12 WordPress & WooCommerce Security Shield Pack
Cybersecurity researchers have disclosed details of what appears to be an artificial intelligence (AI)-assisted attack orchestrated by a suspected China-nexus threat actor that has leveraged the PHP2Shell vulnerabilities to breach exposed systems. The activity
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
The Hacker News · CVE TRACKED (CVE-2026-101767)
£12 WordPress & WooCommerce Security Shield Pack
Threat actors are beginning to probe for a newly patched critical vulnerability in Oracle E-Business Suite (EBS), according to threat intelligence firm Defused Cyber. The vulnerability in question is CVE-2026-101767 (CVSS score: 9.8) , a case of improper authe
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
CISA Advisories · GOV/VENDOR + CVE-2026-41709 VERIFIED
£12 WordPress & WooCommerce Security Shield Pack
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-41709 Broadcom VMWare ESX Insufficient Logging Vulnerability CVE-2026-46300 Linux Kernel Missing Initialization of
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
CISA Advisories · GOV/VENDOR + CVE-2023-4863 VERIFIED
£12 WordPress & WooCommerce Security Shield Pack
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code (CVE-2023-4863), bypass authentication (CVE-2026-16436 and CVE-2026-16437), or perform arbitrary operations (CVE-2026-16438), resulting in info
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
CISA Advisories · GOV / OFFICIAL VENDOR VERIFIED
£12 WordPress & WooCommerce Security Shield Pack
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition, corrupt memory, disclose sensitive information, or potentially execute arbitrary code. The following versions of EPICS Base are a
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
UK NCSC Advisories · GOV / OFFICIAL VENDOR VERIFIED
£29 Cyber Essentials v3.3 ('Danzell') & Entra ID Pack
How industry, the NCSC and the FCA worked together to help organisations share information while protecting market integrity
Drop-In UK Remediation: Enforce Conditional Access phish-resistant MFA, revoke stale OAuth consent grants, and lock external mail forwarding.
UK NCSC Advisories · GOV/VENDOR + CVE-2026-109618 VERIFIED
£12 WordPress & WooCommerce Security Shield Pack
Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).
Drop-In UK Remediation: Lock xmlrpc.php & wp-json user enumeration, disable dangerous PHP eval/exec primitives, and deploy strict HSTS + CSP headers.
