security
[Resolved] Web Hosting Outage Until Critical PHP Security Updates are Available
2026-10-21 11:15 PM ET – Plesk has provided updates that patch the vulnerable PHP versions. Those updates have now been installed. Hosted websites and services that use PHP are once again available.
2026-10-21 2:00 AM ET – On October 20, 2026, details of two critical remote code execution (RCE) vulnerabilities in PHP, leaked online before their coordinated disclosure and before patches were released. These vulnerabilities are identified by CVE-2026-109618 and CVE-2026-109619. Emergency patches, to the PHP software, are forthcoming.
A Remote Code Execution (RCE) vulnerability means that an attacker can take over an affected server.
PHP is used by many websites, and is required for websites that run WordPress and similar content management systems (CMS).
These vulnerabilities affect Widomaker’s Plesk server that provides website hosting to customers, as well as Widomaker’s own websites and weblog. Additionally, many website contact forms, including Widomaker’s own website contact forms, are PHP based and will be affected.
Due to the extreme severity of this vulnerability, and in order to avoid a full server compromise/breach, we plan to follow the advice of experts and isolate PHP, and the hosted websites that use it, from the Internet. This means that many of the websites we are hosting will go down until the PHP foundation and Plesk provide the necessary updates that will again allow running PHP, publicly on the Internet, safely. This could take several days. Some of Widomaker’s own websites will be affected.
Widomaker’s online ticketing system uses PHP, so that may not be available until updates are made available to us.
Furthermore, older versions of PHP (prior to version 8.2), that are no longer supported by the PHP foundation, may not receive a patch or update to fix the vulnerability. In that case, those web hosting customers who are using older unsupported versions may need to update their websites to use a supported version of PHP before their websites can go online again.
We apologize for the interruption in web hosting service, however, this critical vulnerability requires that we take these steps to protect our server and our customers’ data.
Updates, when available, may be found on our website (on an as available basis), our Facebook page, and our Status Page.
During this time, please try to avoid contacting us unless it is absolutely necessary and urgent, as we will be focusing our limited resources on following the progress of available updates and patches, and installing them once available. If you do need to reach us, email us using our helpdesk address found on our contact page.
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code on WordPress Websites
Websites that use the WordPress content management systems (CMS) should update immediately.WordPress 6.9.5 and 7.0.2 patch wp2shell, a pre-auth core RCE that lets anonymous attackers run code on default installs, even with no plugins.
Source: New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Warning: Why You Should Avoid Microsoft’s New Outlook for Email
TL;DR: Avoid the “New Outlook” or “Outlook (New)” application for email. Use Thunderbird, Widomaker Webmail, “Classic Outlook”, or another traditional email client, instead.
Microsoft’s “New Outlook” application is rolling out, and while it brings a fresh look, it introduces a significant change for users with non-Microsoft email accounts, particularly those using IMAP. If you value your privacy and data security, you need to be aware of how it handles your information.
Have You Been Pwned?
Protect Your Digital Identity with Have I Been Pwned
In today’s digital world, data breaches happen frequently. Your personal information could be exposed without your knowledge, putting your online accounts at risk.
FBI: End-of-life routers hacked for cybercrime proxy networks
Is your router end-of-life (EoL)? If so, it’s best to replace it to avoid it being exploited to route malicious traffic. More details are in this article, linked below. A short list of currently exploited EoL routers are… Linksys E1200, E2500, E1000, E4200, E1500, E300, E3200, E1550, WRT320N, WRT310N, WRT610N, Cisco M10
The FBI warns that threat actors are deploying malware on end-of-life (EoL) routers to convert them into proxies sold on the 5Socks and Anyproxy networks.
Source: FBI: End-of-life routers hacked for cybercrime proxy networks
Infostealer malware stole 493 million accounts. Is yours one of them?
Recently, news surfaced about stolen data containing billions of records, with 284 million unique email addresses affected.
Read the following article for steps to check if your email was found in the stolen data…
Source: Infostealer malware stole 493 million accounts. Is yours one of them? | PCWorld
Operation Endgame – 300 Widomaker.com Email Accounts Found Among 16.5M Compromised Accounts
What Happened?
Between May 27 and May 29, 2024, an international law enforcement operation, Operation Endgame, seized over 100 cybercrime servers worldwide. It’s being called the largest ever operation against botnets.
Approximately 300 (active and inactive) @widomaker.com email accounts, and passwords, were identified as having been potentially compromised for use by the Endgame cybercrime groups, sometime during the time period the groups were active. This means the affected users’ passwords were potentially compromised via remote access trojans (RATs) or info-stealers (malware installed on the users’ computers). To find out more, review the article and video, from Microsoft, about How malware can infect your PC…
According to Spamhaus, “The botnet operators in question relied on compromised accounts to target victims and spread malicious emails. If a receiver interacted with one of these emails, it is highly likely that their device was infected. As a result, they probably became part of the targeted botnets.”
More details on Operation Endgame may be found at the links below…
- [Bleeping Computer] Police seize over 100 malware loader servers, arrest four cybercriminals
- [Krebs on Security] ‘Operation Endgame’ Hits Malware Delivery Platforms
- [Europol] Largest ever operation against botnets hits dropper malware ecosystem
- [Troy Hunt / Have I Been Pwned (HIBP)] Operation Endgame
What Should I Do?
The easiest way to tell if your email address is in the Operation Endgame data, or other data breaches, is to sign up, for free, to be notified when your email address appears in known data breaches, or is found, via law enforcement action, to be compromised, like in the case of Operation Endgame. The Have I Been Pwned notification service is free to individuals. Visit the HIBP website, via the link below, then click “Notify me” to sign up for notifications.
Most importantly, if you find that your email address(es) is/are in the Operation Endgame data, or other data breaches, you should scan your computers (or other devices) for malware, and reset the passwords of the affected email accounts to prevent further abuse. You may Contact our office for assistance.
Check if you are a victim of the Qakbot Malware!
The Justice Department today announced a multinational operation involving actions in the United States, France, Germany, the Netherlands, the United Kingdom, Romania, and Latvia to disrupt the botnet and malware known as Qakbot and take down its infrastructure. [1]
On August 29th, 2023, the FBI provided Have I Been Pwned (HIBP) with 6.43M email addresses to help notify impacted victims of their exposure to the Qakbot malware. Anyone may check to see if their email address is included in the list of victims of the Qakbot malware via the HIBP notification service.
We recommend that everyone subscribes to the free notification service provided by Have I Been Pwned (HIBP) which can notify you if your email address is found in certain data breaches, including being in the Qakbot data.
Qakbot relied on compromised accounts to spread its malicious emails. If a receiver interacted with one of these emails, it is highly likely that their device became infected. As a result, they would have become part of the Qakbot botnet. [2]
If you find that your email address is in the Qakbot data, meaning your computer was probably infected with the malware, you should take several actions, including resetting your email password, and resetting any other passwords that were used on the infected computer (banking, shopping, etc.). Also, it’s possible your computer is infected with other additional malware, it should be scanned by a reputable antivirus/anti-malware product such as Malwarebytes or Windows Defender. Since Qakbot targets, among other things, banking/financial details, you should carefully review bank statements for unauthorized transactions and report any you find to your financial institution.
TP-Link Archer WiFi router flaw exploited by Mirai malware
The Mirai malware botnet is actively exploiting a TP-Link Archer A21 (AX1800) WiFi router vulnerability tracked as CVE-2023-1389 to incorporate devices into DDoS (distributed denial of service) swarms.
Source: TP-Link Archer WiFi router flaw exploited by Mirai malware
How to Recover from a Phishing Password Compromise
What is a Phishing Password Compromise?
A phishing password compromise occurs when an attacker tricks you into revealing your login credentials, such as your username and password, through a phishing attack. Once the attacker has your login credentials, they can access your account and steal sensitive information or use your account for malicious purposes.
