Reliable Penguin is aware of public reports regarding CVE-2026-49975, also referred to as the HTTP/2 Bomb vulnerability.

This issue may allow a remote attacker to exhaust server memory on affected HTTP/2-enabled web servers, potentially causing service disruption or denial of service. Public reporting indicates that the issue relates to HTTP/2 header compression behavior and may affect multiple web server and proxy implementations, including NGINX, Apache HTTP Server, Microsoft IIS, Envoy, and Cloudflare Pingora.

Current status

Reliable Penguin is reviewing managed server environments and applying appropriate mitigations.

At this point, no customer action is necessary.

We will provide updates as they become available.

What customers should do

No action is required from Reliable Penguin managed hosting customers at this time.

Customers with questions may open a support request through the Reliable Penguin help desk.

References

• The Hacker News: “New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & Cloudflare” , published June 3, 2026.
• Calif: “Codex Discovered a Hidden HTTP/2 Bomb” , published June 2, 2026.
• mod_http2 release notes: Version 2.0.41 release notes , noting a fix for cookie header accounting against LimitRequestFields.

Summary

Wordfence published an advisory for a critical unauthenticated privilege escalation vulnerability in the Advanced Custom Fields: Extended WordPress plugin. The issue affects Advanced Custom Fields: Extended versions up to and including 0.9.2.5 and is patched in version 0.9.2.6. Wordfence assigned the vulnerability a CVSS score of 9.8, which is considered critical.

According to Wordfence, the vulnerability may allow an unauthenticated attacker to escalate privileges by abusing validation handling related to the _acf_post_id parameter. The advisory notes that exploitation depends on site configuration, specifically whether the site exposes a public ACFE frontend form configured with a Create User action that maps a role field.

Reliable Penguin Response

Reliable Penguin used our internal RP Anvil system to review managed servers for WordPress installations using vulnerable Advanced Custom Fields: Extended plugin versions.

As part of this review, RP Anvil scanned managed systems for Advanced Custom Fields: Extended plugin installations and checked installed versions against the vulnerable range identified in the advisory.

At this time:

• Managed servers have been reviewed.
• Clients with potentially vulnerable WordPress installations have been notified directly.
• No client action is required at this point for Reliable Penguin managed systems unless we have contacted you directly.

What Clients Should Do

For Reliable Penguin managed systems, no action is required unless you have received a direct notification from us.

For WordPress sites not managed by Reliable Penguin, site owners should review their installations and update Advanced Custom Fields: Extended to version 0.9.2.6 or newer. Wordfence recommends updating as soon as possible due to the critical nature of this vulnerability.

Site owners should also review any public ACFE frontend forms, especially forms configured to create users or assign user roles.

Additional Resources

• Wordfence Intelligence: Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation
• Advanced Custom Fields: Extended plugin page on WordPress.org

Questions

If you have questions about this vulnerability or your managed WordPress environment, please contact Reliable Penguin support.

Summary

Wordfence published an advisory for a critical unauthenticated privilege escalation vulnerability in the Kirki WordPress plugin. The issue affects Kirki versions 6.0.0 through 6.0.6 and is patched in version 6.0.7. Wordfence assigned the vulnerability a CVSS score of 9.8, which is considered critical.

According to Wordfence, the vulnerability can allow an unauthenticated attacker to take over user accounts, including administrator accounts, by abusing the plugin’s password reset functionality.

Reliable Penguin Response

Reliable Penguin used our internal RP Anvil system to review managed servers for WordPress installations using vulnerable Kirki plugin versions.

As part of this review, RP Anvil scanned managed systems for Kirki plugin installations and checked installed versions against the vulnerable range identified in the advisory.

At this time:

• Managed servers have been reviewed.
• Clients with vulnerable WordPress installations have been notified directly.
• No client action is required at this point for Reliable Penguin managed systems unless we have contacted you directly.

What Clients Should Do

For Reliable Penguin managed systems, no action is required unless you have received a direct notification from us.

For WordPress sites not managed by Reliable Penguin, site owners should review their installations and update Kirki to version 6.0.7 or newer. Wordfence recommends updating as soon as possible due to the critical nature of this vulnerability.

Additional Resources

• Wordfence: Unauthenticated Privilege Escalation Vulnerability Patched in Kirki WordPress Plugin
• Wordfence Intelligence vulnerability summary for Kirki
• Kirki plugin page on WordPress.org

Questions

If you have questions about this vulnerability or your managed WordPress environment, please contact Reliable Penguin support.

Reliable Penguin is introducing RP Periscope, a new security update monitoring system designed to help our team track important software, platform, and vendor security advisories more consistently.

RP Periscope gives Reliable Penguin a centralized way to monitor security information from trusted sources and evaluate whether those updates may affect the systems, websites, and infrastructure we manage for our clients.

Security advisories are often spread across many different vendor sites, mailing lists, release notes, RSS feeds, and technical bulletins. RP Periscope helps bring that information together so our team can review it more efficiently and respond when action may be needed.

What RP Periscope monitors

RP Periscope monitors security-related updates from sources connected to technologies commonly used across Reliable Penguin managed environments, including:

• Linux distributions such as AlmaLinux and Ubuntu
• Hosting control panels such as Plesk and cPanel
• CMS platforms such as WordPress and Drupal
• WordPress plugins, themes, and related ecosystem advisories
• Infrastructure software and vendor security bulletins
• Other relevant security feeds and update sources

How RP Periscope helps

RP Periscope supports Reliable Penguin’s security operations by helping us identify and organize security updates that may require review, follow-up, or client communication.

The system helps our team:

• Monitor security advisories from multiple trusted sources
• Identify potentially urgent vulnerabilities
• Classify alerts by relevance and urgency
• Improve visibility across managed client environments
• Support faster internal review and response
• Communicate more clearly when client action may be required

What this means for Reliable Penguin clients

For clients, there is no action required as part of this announcement. RP Periscope is an internal Reliable Penguin system that strengthens our ability to monitor security developments and respond appropriately.

When a security update, vulnerability, or vendor advisory requires action on a client system, Reliable Penguin will continue to communicate directly through our normal support and account channels.

RP Periscope does not replace regular maintenance, patching, backups, monitoring, or security best practices. Instead, it adds another layer of visibility to help our team stay informed about emerging risks and important updates.

Why we built RP Periscope

Modern websites and hosting environments depend on many different layers of software. Operating systems, control panels, web servers, CMS platforms, plugins, themes, libraries, and vendor tools can all have security updates that matter.

Because these updates come from many different sources, it can be difficult to track everything manually and consistently. RP Periscope was built to help Reliable Penguin centralize this monitoring and make security review more systematic.

By improving how we collect and review security advisories, we can better prioritize issues, reduce noise, and focus attention on updates that may matter most to our clients.

Our goal

RP Periscope reflects Reliable Penguin’s ongoing investment in managed hosting, maintenance, and security operations.

Our goal is simple:

We See Threats. You Stay Secure.

RP Periscope is one more way Reliable Penguin helps clients stay informed, protected, and prepared.

The issue affects the interaction between the Linux kernel’s CIFS/SMB client and the user-space cifs-utils authentication helper. CIFS is commonly used to mount SMB/Windows-style network shares on Linux systems. The vulnerability is most relevant on systems where CIFS/SMB support and cifs-utils are installed, especially where Kerberos/SPNEGO authentication support is present.

What is the vulnerability?

CIFSwitch is a local privilege escalation vulnerability. It does not allow remote exploitation by itself. An attacker generally needs local access to the system first, such as a shell account, compromised web user, compromised container context, or another foothold.

The vulnerability involves forged cifs.spnego key requests. Under vulnerable conditions, an unprivileged user can trigger the normal CIFS authentication workflow and cause the root-run cifs.upcall helper to trust attacker-controlled fields. The public technical analysis describes an exploit chain involving namespace switching and Name Service Switch behavior before privileges are dropped, which can result in root code execution.

Who may be affected?

The vulnerability is not universal, but several common Linux distributions or configurations may be affected.

Affected or potentially affected environments include combinations of:

• A vulnerable Linux kernel
• cifs-utils, particularly systems where the cifs.upcall helper is present
• CIFS/SMB client functionality enabled or available
• Unprivileged user namespaces enabled
• SELinux, AppArmor, or other local security policies that do not block the exploit path

Public reporting and vendor advisories indicate that this issue can affect multiple Linux distributions depending on package versions, kernel updates, and local security policy.

Reliable Penguin response

Using our automation platform, Reliable Penguin has reviewed all servers in our managed fleet for exposure to this vulnerability and has taken appropriate mitigation steps where needed.

At this point, no action is necessary from clients.

If we identify any system-specific concerns that require client involvement, we will contact the affected client directly.

References

• BleepingComputer: New CIFSwitch Linux flaw gives root on multiple distributions
• Technical analysis: CIFSwitch: a non-universal Linux local root vulnerability
• Openwall oss-security disclosure: CIFSwitch Linux kernel/cifs-utils local root via forged CIFS SPNEGO description
• CloudLinux: CIFSwitch Mitigation and Kernel Update

Published: May 23, 2026

Status: Reviewed and remediated

Client action required: No

Reliable Penguin has completed a review of all managed WHM/cPanel servers in response to the recently disclosed LiteSpeed cPanel plugin vulnerability, tracked as CVE-2026-48172.

This vulnerability affects certain versions of the LiteSpeed User-End cPanel Plugin and may allow privilege escalation on impacted systems. The issue does not affect every WHM/cPanel server, but it is relevant to environments where the affected LiteSpeed cPanel user-end plugin was installed.

As part of our managed security response, Reliable Penguin has:

• Reviewed all managed WHM/cPanel servers for exposure.
• Identified whether the affected LiteSpeed cPanel plugin was present.
• Applied appropriate vendor patches and/or mitigations where needed.
• Confirmed that no client-side action is required at this time.

LiteSpeed web service functionality is not expected to be impacted by the mitigation steps. Websites using LiteSpeed or LiteSpeed Cache should continue to operate normally.

We will continue monitoring vendor advisories and security updates related to this issue. If any additional action becomes necessary for a managed server, Reliable Penguin will handle it directly or contact affected clients with specific instructions.

For questions, please contact Reliable Penguin Support.

Summary: Reliable Penguin has reviewed all managed WHM/cPanel servers for CVE-2026-48172 and applied appropriate patches and/or mitigations. No client action is necessary at this time.

The vulnerability is tracked as CVE-2026-9082 and has been rated Highly critical, 20/25 by the Drupal Security Team. The primary issue affects Drupal sites using PostgreSQL databases. Drupal states that the vulnerability may be exploitable by anonymous users and could allow arbitrary SQL injection, potentially leading to information disclosure, privilege escalation, remote code execution, or other attacks.

Drupal has also included coordinated upstream dependency security updates for Symfony and Twig in the supported Drupal core releases. Because of those dependency updates, Drupal recommends updating even for sites that are not using PostgreSQL.

Reliable Penguin does not perform Drupal application updates. Drupal site owners and administrators should review their own Drupal installations, determine whether their sites are affected, and take appropriate action based on Drupal’s official advisory.

Affected Drupal versions include Drupal core versions from 8.9.0 through versions before 10.4.10, 10.5.x before 10.5.10, 10.6.x before 10.6.9, 11.0.x before 11.1.10, 11.2.x before 11.2.12, and 11.3.x before 11.3.10. Drupal recommends updating to the latest available release for your supported branch.

Site owners should apply updates promptly and review which user roles have permission to update Twig templates, such as through Views or contributed modules.

Read the official Drupal security advisory:
https://www.drupal.org/sa-core-2026-004

For urgent questions, please contact Reliable Penguin support.

Reliable Penguin is monitoring the release window and will review the advisory as soon as Drupal publishes the update. If any hosted or managed Drupal sites are affected, we will prioritize applying the required security updates and mitigation steps.

Drupal has indicated that not all configurations may be affected, but site owners should reserve time during the release window to evaluate and apply updates promptly. Exploit details may become available within hours or days after disclosure.

Read the official Drupal security release notice

For urgent questions, please contact Reliable Penguin support.

cPanel has released the security patches for this notice ahead of the originally scheduled release time. The patched builds are now available for affected versions of cPanel & WHM.

This release addresses multiple security issues, including vulnerabilities rated up to High severity. cPanel has identified the following items as addressed in this release:

• SEC-73728: cPanel & WHM / WP2 Security Update May 19, 2026
• SEC-73755: cPanel & WHM / WP2 Security Update May 19, 2026
• LiteSpeed User-End cPanel Plugin: A privilege-escalation vulnerability allowing unauthorized root access. cPanel has stated this issue is actively being exploited in the wild. As an interim security measure, cPanel has included an automated fix in this release that removes the plugin. Read the cPanel LiteSpeed plugin security notice .

Minimum Patched Builds

Servers should be updated to the appropriate patched build or later:

Reliable Penguin Response

Reliable Penguin is applying the available cPanel & WHM security updates across managed client servers. We strongly recommend that any affected servers not managed by Reliable Penguin be updated manually as soon as possible.

For servers managed by Reliable Penguin, no customer action is required unless we contact you directly regarding a maintenance window or special update requirement.

Where a manual update is required, the update can be applied with:

/scripts/upcp

Note for CentOS 6 or CloudLinux 6 systems: cPanel advises updating to the cl6110 branch, version 11.110.0.120, before manually updating.

We will continue monitoring this issue and will take any additional remediation steps as needed.

May 18, 2026

Reliable Penguin has been notified by cPanel that a cPanel & WHM security patch is expected to be released on Wednesday, May 20, 2026 at 8:00 AM Eastern Time.

According to cPanel, this release will address multiple vulnerabilities across several versions of cPanel & WHM, including vulnerabilities rated up to High severity.

cPanel has stated that there are currently no known exploits or proof-of-concept code in the wild. Technical details are expected to be released alongside the patches.

Affected Versions

The following cPanel & WHM versions are expected to be impacted:

• 86
• 94
• 102
• 110
• 110 (CL6)
• 118
• 124
• 126
• 130
• 132
• 134
• 136
• 136 (WP2)

Reliable Penguin Response

Reliable Penguin is reviewing managed cPanel & WHM servers for affected versions and will apply the security update once it becomes available.

For servers managed by Reliable Penguin, no customer action is required at this time unless we contact you directly regarding a maintenance window or special update requirements.

Next Steps

We will continue monitoring the release and will provide an update once the patch is available and remediation work is underway.

We encourage all Reliable Penguin clients to join the list so they can receive timely notices about:

• Important security updates
• Operational notices and service-related announcements
• New Reliable Penguin product offerings
• Opportunities, events, and other updates from our team

Our goal is to make sure clients have a clear and reliable way to hear about information that may affect their websites, hosting, infrastructure, support, or services with Reliable Penguin.

Why join?

RP News will help you stay ahead of important changes and opportunities. Some updates may be informational, while others may include security or operational details that are important for your organization to review.

By joining the mailing list, you can make sure the right people on your team receive these updates directly.

Who should subscribe?

We recommend that each client organization have at least one primary contact subscribed. Depending on your team, you may also want to include:

• Website administrators
• IT or security contacts
• Operations managers
• Marketing or communications contacts
• Anyone responsible for Reliable Penguin services within your organization

Join the RP News list

Please use the signup form below to subscribe to the RP News mailing list and stay informed about Reliable Penguin updates, important notices, new offerings, and opportunities.

If you are unsure who from your organization should be subscribed, please contact Reliable Penguin support and we will be happy to help.

Plesk has released Plesk Obsidian 18.0.78 Update 1, which includes security improvements and updates nginx and the sw-cp-server service to version 1.30.1 on Linux systems. Reliable Penguin is in the process of installing this update across all managed client servers. 

No customer action is required at this time. We will continue monitoring the rollout and will take any additional remediation steps as needed.

Reference: https://docs.plesk.com/release-notes/obsidian/change-log/

May 15, 2026

Reliable Penguin is aware of CVE-2026-42945, a vulnerability affecting certain nginx versions prior to 1.31.1 and 1.30.1. The issue may allow denial of service in affected configurations, and remote code execution may be possible in limited circumstances.

This vulnerability may affect some Plesk-managed Linux systems depending on the installed nginx version and rewrite-rule configuration.

Reliable Penguin is actively reviewing managed systems for exposure to this issue. Our response includes checking nginx versions, reviewing potentially affected rewrite rules, confirming relevant system protections where applicable, and applying vendor-recommended mitigations or updates.

Reliable Penguin now follows an update-and-notify security maintenance model for managed systems. Under this policy, automatic security updates are enabled by default, and critical or high-priority security updates may be applied as soon as practical rather than waiting for a scheduled maintenance window. Clients are notified after updates that require or result in a system reboot, while routine service restarts generally do not trigger separate notifications.

For this nginx vulnerability, Reliable Penguin may apply mitigations or vendor patches without prior client approval when delaying action would create unnecessary security risk. No system reboots are required for the currently recommended mitigations or expected update. A brief nginx service restart or reload may occur as part of mitigation or patching, but this is considered routine security maintenance and will not typically trigger a separate notification.

Customers do not need to take action unless they manage their own nginx, Plesk, or server configuration outside of Reliable Penguin’s managed services. Customers with self-managed systems should review vendor guidance, confirm whether affected nginx versions and rewrite rules are present, and apply the recommended update or mitigation.

We will continue monitoring vendor guidance and will update this notice as new information becomes available.

Reference: Plesk advisory for CVE-2026-42945

Last updated: May 22, 2026

May 22, 2026

Additional technical details about CVE-2026-46333 have now been publicly disclosed, including reports describing local privilege escalation and potential disclosure of sensitive local files on affected Linux systems.

Reliable Penguin has completed review and remediation across client servers under our management. All client servers have either had available vendor patches installed or the recommended mitigation applied where a patch was not yet available.

We continue to monitor upstream vendor guidance and will apply any additional updates as they become available. No customer action is required at this time unless contacted directly by Reliable Penguin support.

May 16, 2026

CloudLinux and KernelCare have both released updates to address CVE-2026-46333. Alma Linxu has a patch in the testing channel which we expect to enter general distribution over the weekend.

May 15, 2026

Reliable Penguin is aware of CVE-2026-46333, a recently disclosed Linux kernel vulnerability involving `ptrace` access control logic.

We are monitoring guidance from the Linux kernel maintainers, CloudLinux, AlmaLinux, Ubuntu, Red Hat, KernelCare, and other relevant upstream vendors. As patched kernels and live patches become available from the appropriate upstream sources, we will apply updates across affected systems and perform any required reboots.

Consistent with Reliable Penguin’s update-and-notify model, critical and high-priority security updates may be applied as soon as practical rather than waiting for a scheduled maintenance window. Clients with Enterprise level support plans will be notified when possible after updates that require or result in a system reboot. When practical, reboots will be performed between midnight and 6:00 AM Eastern Time, though urgent security conditions may require action outside that window.

No customer action is required at this time unless contacted directly by Reliable Penguin support.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-46333

https://tuxcare.com/cve-tracker/cve/details/cve-2026-46333

https://almalinux.org/blog/2026-05-15-ssh-keysign-pwn-cve-2026-46333/

https://blog.cloudlinux.com/ptrace-exit-race-cve-2026-46333-mitigation-and-kernel-update

https://lwn.net/Articles/1073060/

https://ubuntu.com/security/CVE-2026-46333

https://thehackernews.com/2026/05/9-year-old-linux-kernel-flaw-enables.html

Benefits of our Managed Domain Registrar service include:

• Support from our friendly, competent and experienced engineers including managed inbound domain transfers for seamless transitions.
• Domain registration via our OpenSRS partnership with guaranteed ICANN compliance including automated registrant validation and expiration reminder emails.
• Domain Name Service (DNS) hosted on Reliable Penguin’s ultra-reliable platform built on Amazon Web Services.
• Automatic domain renewals to avoid accidental expirations.
• Optional domain contact privacy to keep your personal information confidential.

Effective July 1, 2024, the following rates will apply to all new domain registrations, renewals and transfers of existing domains.

Reliable Penguin can provide registration for any of over 700 popular gTLDs and ccTLD. Contact support for pricing for additional top level domains.

The optional Domain Contact Privacy feature is available for an additional $5/year per domain.

t2.small - Previous: 0.08 / New: 0.12
t3.micro - Previous: 0.08 / New: 0.12
t2.micro - Previous: 0.08 / New: 0.12
t3.small - Previous: 0.08 / New: 0.12
t2.large - Previous: 0.08 / New: 0.12
t3.nano - Previous: 0.02 / New: 0.04
t3a.nano - Previous: 0.02 / New: 0.04
t3a.medium - Previous: 0.08 / New: 0.12
t3a.small - Previous: 0.08 / New: 0.12
t2.medium - Previous: 0.08 / New: 0.12

For the typical customer this change will result in a $30/most increase in AWS cost. This change takes on July 1st, 2024.

Email support@reliablepenguin.com with any questions.

By purchasing from Reliable Penguin you can save at least 7.5% on monthly licenses and over 15% on annual licenses.

Please contact Reliable Penguin with questions or to order new licenses.