July was the busiest security month we've seen in years: an unauthenticated remote code execution bug in WordPress core itself, plus five separate Linux kernel root exploits. Here's what happened, what was already handled on our managed servers, and what's worth your attention.

wp2shell: WordPress core itself was the vulnerability

On July 17, WordPress shipped 7.0.2 / 6.9.5 / 6.8.6 fixing "wp2shell": a chain of two core bugs (CVE-2026-60137, an SQL injection in WP_Query, and CVE-2026-63030, a REST /batch/v1 endpoint desync) that gave attackers full site takeover with a single anonymous request. No plugins required; a stock install was exploitable. Patchstack observed first exploitation attempts ~90 minutes after the fix was released.

Practically all our servers run Imunify360, which pushed fleet-wide WAF rules within ~12 hours of disclosure. Those rules have since blocked 29M+ exploitation attempts across the fleet, so your sites were virtually patched before the exploitation wave peaked. We also verified WordPress versions across managed sites rather than trusting the forced auto-updates.

Layering helps, though: Monarx had behavioural detection active before public disclosure (it catches the dropped webshell regardless of how it got in), and for sites behind Patchstack the campaign was, in their words, a non-event: its RapidMitigate rules were deployed the moment the advisory went out, before the first exploitation attempts arrived. Patchstack was also the one to reveal that most URL-based WAF rules industry-wide were bypassable via the POST body.

A summer of Linux root exploits

Five kernel privilege-escalation bugs landed in July: GhostLock (CVE-2026-43499, a 15-year-old rtmutex use-after-free), Bad epoll (CVE-2026-46242), RefluXFS (CVE-2026-64600, in every kernel since 2017), an IPv6 fragmentation escape affecting CloudLinux 10 only, and Januscape (CVE-2026-53359), a KVM guest-to-host escape. The common thread: one compromised site or VM becomes full server compromise.

OVH rebooted the infrastructure behind roughly a million customers over eleven days to fix Januscape. Our managed servers run KernelCare, so all five were livepatched without a single reboot or maintenance window.

LiteSpeed 6.4: Anubis proof-of-work and ALTCHA, just released

LiteSpeed Web Server 6.4 adds two significant bot-blocking tools. Anubis is a proof-of-work challenge that runs before requests ever reach your site: a visitor's browser must complete a small computational puzzle, which is trivial for a human's browser but expensive at bot scale. It runs as its own backend service and can be enabled per server or per virtual host. Alongside it, ALTCHA support (including an invisible variant) joins reCAPTCHA and hCaptcha as an open-source, privacy-friendly CAPTCHA option, with no Google dependency. When both are enabled, Anubis filters first and CAPTCHA verifies after, giving a layered defence. This is an important update for bot blocking: 6.4 was just released as an RC (release candidate), so we'll do some beta testing over the coming weeks before it goes stable and we roll it out.

Imunify360 now throttles AI bots instead of letting them flatten your site

AI crawler load has become a genuine cause of "why is my site slow" tickets. Imunify cites one AI crawler making 3.75 million add-to-cart requests to a single store in a day. The new AI Bot Management in the Imunify Security WordPress plugin classifies traffic into six categories, verifies crawler identity against operators' published IP ranges (140+ signatures; spoofed User-Agents don't pass), and rate-limits verified AI crawlers with HTTP 429 + Retry-After instead of blocking them. Your content stays in AI search results; the CPU bill stops climbing. It runs before WordPress loads, so a throttled request never costs a full page render, and it fails open. Three presets (Balanced / Strict / Monitor), free with Imunify360, which our Enterprise/Semi-Dedicated servers and most of our managed cPanel servers already run.

Where cPanel is heading

cPanel published its 2025 survey results, the clearest public roadmap in years. The headline: a native firewall manager ("WebPros Shield") to replace the discontinued CSF, targeted for H2 2026, was the top request at 46.3%. Also coming: native incremental backups via a Comet Backup integration (Q3 2026), a Business Email / webmail upgrade to replace the ageing Roundcube (Q3 2026), and a unified security/performance advisor (Q4 2026). In parallel, cPanel opened early access for cPanel AI: a redesigned end-user UI (Meridian), an in-panel AI assistant that diagnoses SSL/disk/email issues, AI site builders, Node.js app hosting, and MCP connectivity for AI agents, all opt-in. We'll evaluate these as they mature; nothing changes on your servers without our testing first.

Immutable backups: Object Lock is coming to JetBackup 5

Ransomware operators have learned to go after backup repositories and admin credentials before encrypting anything; it's why ransomware featured in 44% of breaches in Verizon's 2025 DBIR. JetBackup's answer is Object Lock, coming to JetBackup 5: S3-style immutability that locks selected backup versions at the storage level for a set retention window, so they cannot be altered or deleted, even by an attacker holding root on the server or valid admin credentials. This is the strongest structural answer yet to backup-targeting ransomware, and we'll be planning it into our JetBackup-based backup chains once it ships.

In brief

• JetBackup 5.4.1 was promoted to the Release tier with security dependency updates and restore-reliability fixes, and JetBackup for WordPress passed 200,000 active installations.
• Running WP-CLI as root? --allow-root executes every mu-plugin as root, even for wp plugin list, and a real malware family is exploiting exactly that; audit your cron jobs.
• Acronis agent 26.7 fixed the installation failure (file_protector kernel module) on AlmaLinux/Rocky Linux 9.8.
• DirtyClone (CVE-2026-43503), a new PoC for the Dirty Frag kernel bug family, is already covered by May's patches.
• Many "hosting hacks" are credential reuse: Monarx's case study of a compromise via a password leaked in 2021 is a good argument for enabling 2FA everywhere.
• Patchstack is extending its vulnerability monitoring to Node.js applications for hosting providers, a sign of where shared-infrastructure security is heading.

That's July. If anything above raises questions about your own servers (extra security layers, backup immutability, bot handling), simply open a ticket.