The vulnerabilities we handled at infrastructure level, plus the WordPress updates worth checking.

August 2026 at Fusioned

August brought several significant WordPress and Linux vulnerabilities. For us, the important question is not simply whether a patch exists. It is how long systems remain exposed, whether the fix requires downtime, and how we verify that it reached every affected server.

Whether your website runs on our Enterprise or Semi-Dedicated Hosting, or you use a cloud or dedicated server managed by Fusioned, the objective is the same: reduce exposure without compromising availability.

Two important WordPress core updates

WordPress released two security updates in the space of one week.

WordPress 7.0.3 fixed 12 vulnerabilities. The most serious, CVE-2026-64638, was an unauthenticated reflected cross-site scripting vulnerability on the login page. It could lead to remote code execution if a logged-in administrator opened a specially crafted link.

The attack did not propagate by itself, but wp-login.php is one of the most continuously scanned WordPress endpoints. Imunify360 recorded 2.6 million exploitation attempts against this vulnerability during the first 12 days after disclosure.

WordPress 7.0.4 addressed a different remote code execution vulnerability. A user with Author-level access could upload PostScript content disguised as an image. WordPress trusted the filename extension, while ImageMagick inspected the actual content and passed it to Ghostscript for processing. That difference in interpretation could result in code execution on the server.

The issue affected WordPress versions going back to 4.7. Anyone who gives Author access to contributors, customers, or external teams should treat this update as a priority.

What virtual patching covers

Updating WordPress remains the correct permanent fix. The operational problem is the interval between public disclosure and complete deployment across every website.

Imunify360 provides server-wide WAF protection across Fusioned-managed infrastructure. Its rules inspect malicious requests before vulnerable WordPress code executes. This gives sites protection while application updates are being tested or deployed.

For CVE-2026-64638, Patchstack published its per-site RapidMitigate rules within approximately two hours of the WordPress announcement. The corresponding Imunify360 rules reached our servers the following day.

The difference reflects two distinct models:

• Imunify360 operates across the entire server and protects all hosted websites under one server-level licence. It is part of our standard security stack.
• Patchstack operates per WordPress installation and can deliver narrowly targeted rules very quickly. It is available as an optional layer for individual sites where even a few additional hours of exposure matter.

A WAF is a compensating control, not permission to leave software outdated. It reduces the risk during the update window, but the vulnerable code should still be replaced.

Kernel vulnerabilities without emergency downtime

The application layer was only part of August's security work. Several Linux kernel vulnerabilities also required assessment.

BadGarbage, CVE-2026-53361, affected CloudLinux 10 and allowed a local user or container process to reach root on the host. CloudLinux reproduced the public exploit from a default Docker container in under 30 seconds. There was no configuration-based workaround. The available options were a kernel update followed by a reboot, or a KernelCare live patch.

Other disclosures included Zapscape, a KVM guest escape requiring a specific combination of KVM access, nested virtualisation, and compatible hardware; RtabRace, which primarily exposed affected hosts to an unprivileged denial of service; and SCTPhantom, a local privilege escalation involving the SCTP kernel module.

These vulnerabilities did not affect every server in the same way. Exposure depended on the CloudLinux version, running kernel, loaded modules, and system configuration.

Our response was therefore host-specific. We checked the relevant version and configuration on each managed system, applied KernelCare live patches where required and available, and verified cases where the default configuration already blocked the vulnerable path. This avoided a blanket reboot campaign and kept hosted services online.

This verification step matters. Installing an automatic patching product is useful, but managed infrastructure should also mean that somebody confirmed the expected protection is actually present.

A useful change in JetBackup

JetBackup 5.4.2 added support for immutable backups through S3 Object Lock.

Immutability prevents a backup from being changed or deleted during its retention period, even if an attacker obtains credentials with access to the backup destination. This is particularly relevant in ransomware incidents, where attackers increasingly target recovery systems before encrypting production data.

We are currently testing this functionality and have not yet enabled it for customer backups.

A successful backup job is not the same as a recoverable system. A resilient backup design needs:

• A copy stored outside the production server
• Credentials that are separate from production access
• Protection against deletion or modification
• A restore path that does not depend on the failed control panel
• Periodic restore testing

Immutability strengthens this design, but it does not replace independent storage and tested recovery procedures.

Meridian is coming to cPanel

cPanel Meridian is expected to become available as an optional theme with cPanel v138.

Meridian reorganises cPanel around tasks such as managing websites, email, security, files, databases, and performance. It will run alongside the existing Jupiter interface. Switching themes does not change website files, email accounts, databases, APIs, or server configuration.

Meridian will also provide access to several new AI-assisted functions. These are not automatically granted control of an account or server. User-level agent access requires explicit activation and is restricted to the individual cPanel account's home directory. Administrative access is a separate capability.

As a cPanel Partner, Fusioned receives early access to these features. We will evaluate their permissions, auditability, and operational behaviour before enabling them broadly.

Infrastructure pricing

The cost of ordinary server hardware is rising across the market, largely because AI infrastructure demand has increased the price of DRAM and NVMe storage.

Hetzner's June repricing increased its AMD shared-vCPU plans by approximately 144% to 175%, while dedicated-vCPU plans increased by approximately 113% to 173%. For example, a CPX52 instance went from €36.49 to €100.49 per month, and a CCX23 instance went from €31.49 to €85.99.

OVHcloud's increases begin in September for new orders and October for renewals. Prices for its latest-generation bare-metal servers will rise by an average of 51%, including 40% for Scale, 49% for Advance, up to 59% for High Grade, and 87% for Game servers. Its public cloud billing changes may increase costs by up to 21.9%. OVHcloud's CEO reported that the company's memory costs had increased roughly sixfold within a year.

For Fusioned customers:

• Existing dedicated servers will not receive a price increase.
• Existing cloud services, together with new cloud and dedicated server orders, will be affected from Q4 2026.
• Existing Enterprise and Semi-Dedicated Hosting plans will remain in place for current customers as legacy products on their existing infrastructure.
• In 2027, we will introduce a new generation of Enterprise and Semi-Dedicated plans on newer hardware. These plans will provide higher single-thread CPU performance and additional security through Monarx, included as standard. They will be priced higher than the current legacy plans to reflect the upgraded hardware and security stack.
• We will provide the exact figures and sufficient notice before any change takes effect.

We are sharing this context now so that upcoming changes are predictable rather than surprising.

Your WordPress action list

The server-level work described above has been handled by us. Updating and maintaining website applications, plugins, and themes remains the website owner's responsibility unless covered by a separate maintenance agreement.

For every WordPress website, confirm that WordPress itself is running the current security release for its branch. Then apply the remaining updates only where the relevant plugin is installed:

• If a website uses LiteSpeed Cache, update it to version 7.9 or later. This fixes CVE-2026-18978, an unauthenticated stored XSS vulnerability that could be delivered through comments under certain configurations.
• If a website uses Elementor Pro, update it to version 4.2.2 or later. Versions up to 4.2.1 contain an unauthenticated file-upload vulnerability that can lead to remote code execution.
• If a website uses GiveWP, update it to version 4.16.7.2 or later. Earlier versions contain CVE-2026-82222, an unauthenticated PHP object injection vulnerability rated CVSS 10.0.
• If a website uses a miniOrange SAML SSO plugin, confirm the exact edition and install its corresponding security update. Because paid editions use separate version lines, a normal WordPress vulnerability scan may not identify the affected version correctly. Review administrator accounts and sessions for unexpected activity.
• If a website uses WP Rocket and is being updated to WordPress 7.1, update WP Rocket to version 3.23.2.2 or later first. Earlier releases can cause a fatal error under WordPress 7.1.

If you are unsure whether a website uses any of these components, contact us with its domain. We can confirm whether the component is present and advise on the required update. Application testing and deployment remain the website maintainer's responsibility unless covered by a separate maintenance agreement.

One final milestone

Fusioned has now funded more than 1,000 trees through Ecologi. Our contribution history and current total are available on our public Ecologi profile.

That is August: several serious vulnerabilities, no emergency maintenance campaign, and a clear application-level checklist for website maintainers.

The Fusioned team