Notices.

Advisories and heads-ups on security, hosting, industry changes and platform updates that affect the websites and tools our clients use. We publish these so you can act on what matters and skip the noise on what doesn't.

Security notice High 7 August 2026

Twelve vulnerabilities exposed across WordPress 4.7 to 7.0.2

WordPress released 7.0.3 on 6 August 2026, fixing twelve separate vulnerabilities. The most serious, CVE-2026-64638, is a pre-authentication flaw on the login screen rated 8.9 out of 10, and it affects every version of WordPress released since 2016. Update to 7.0.3, 6.9.6 or 6.8.7. This arrives three weeks after the WP2Shell chain, and that pattern matters more than any single item on the list.
Security notice Critical 3 August 2026

WP2Shell: critical WordPress core vulnerability chain

WP2Shell chains two flaws in WordPress core to give an anonymous attacker full remote code execution on a stock install, with no plugins, no configuration quirks and no login required. It is being exploited in the wild. If you run WordPress, confirm you are on 6.9.5, 7.0.2 or 6.8.6 or later today, and check your site for the signs of compromise listed below.
Security notice High 9 July 2026

Large-scale exploitation campaign targeting CMS-based websites

A coordinated campaign is exploiting known vulnerabilities in popular CMS platforms to compromise websites at scale. Owners and administrators of WordPress and other CMS-based sites should ensure all core software, plugins and themes are kept up to date, that administrator accounts use strong unique passwords with MFA enabled, and server-level protections such as WAF and file-integrity monitoring are in place.

Ready when you are.

Tell us about your business and where you would like it to go. We will talk through the options and agree a clear scope and plan before anything begins.

Get started

Twelve vulnerabilities exposed across WordPress 4.7 to 7.0.2

WP2Shell: critical WordPress core vulnerability chain

Large-scale exploitation campaign targeting CMS-based websites

Ready when you are.