Cope retweeted
When your primary mailer fails, WordPress emails can stop getting through. WP Mail SMTP Pro’s Backup Connection automatically reroutes emails through a backup mailer when the primary connection fails. Set up a fallback before you need it.
Cope retweeted
PHP has issued updated Windows builds to fix CVE-2026-111497, a critical Brotli decompression vulnerability.
Fixed packages:
• PHP 8.5.12-1
• PHP 8.4.27-1
• PHP 8.3.36-1
• PHP 8.2.35-1
The -1 suffix signals a dependency rebuild, not a new PHP runtime version.
Windows users should update. Linux deployments need to assess their own Brotli packages.
Official notice: php.net/archive/2026.php#202…
Cope retweeted
A high-severity Android flaw, CVE-2026-80097 (CVSS 8.6), let malicious apps impersonate trusted Microsoft apps to steal work-account tokens through Microsoft Authenticator.
Those tokens could expose email, files and calendars.
Patched in version 6.2606.4246. Update now.
‼️Microsoft Authenticator Flaw Lets Malicious Android Apps Steal Account Tokens With Zero Permissions
Details: cybersecuritynews.com/micros…
Microsoft patched high-severity flaw CVE-2026-80097 (CVSS 8.6) in Authenticator for Android, allowing malicious apps with no declared permissions to steal work account access tokens due to improper authentication in its broker component.
Microsoft classified the flaw as a local elevation-of-privilege vulnerability. The issue affected Android devices with Microsoft Authenticator installed and a signed-in work account.
#cybersecuritynews
Cope retweeted
WordPress MCP is a shift from AI giving you instructions to executing tasks on your site.
With WPVibe.ai, you can connect Claude or ChatGPT to WordPress and handle tasks like restoring revisions or updating content through conversation, without managing the MCP server yourself.
Less manual work. More control over your WordPress workflow.
Cope retweeted
CVE-2026-111497 goes well beyond Node.js.
The Brotli decoder flaw spans Bun, Python, .NET, Envoy, Istio, FFmpeg, ClickHouse, Apache Arrow and Ruby’s Brotli gem.
From HTTP responses to crafted images and compressed database files, the attack paths vary.
One vulnerable dependency. Multiple ecosystems. Different risks and patch timelines.
🚨 UPDATE: The Brotli flaw (CVE-2026-111497) goes beyond Node.js and web traffic.
• .NET: patched by Microsoft
• FFmpeg: hit via a crafted JPEG XL image
• ClickHouse: one request crashes it, fix not yet released
• Apache Arrow: no fix yet
Details ↓ thehackernews.com/2026/10/br…
Cope retweeted
Cookie scanners can miss cookies triggered by user actions, such as clicking Add to Cart.
WPConsent’s Cookie Inspector helps you identify these cookies in real time, understand which scripts set them, and manage consent so non-essential cookies are blocked until visitors agree.
That makes it easier to find hidden tracking and tighten your site's consent setup.
Cope retweeted
Want to keep your WordPress backups off your web server?
This guide shows you how to set up Duplicator Cloud and send your backups to off-site storage.
duplicator.com/knowledge-bas…
Cope retweeted
Patching a security vulnerability is one thing.
Recovering from an incident is another.
Your WordPress site can be fully patched and still need a recovery plan.
If an attacker compromises your server, having backups on that same server may not be enough.
You could lose access to both your website and the backups you were counting on.
There's another problem.
If WordPress crashes and you can't access wp-admin, a recovery process that depends on logging into wp-admin becomes a problem of its own.
This is why I treat recovery as a separate layer of security.
Keep backups off-site.
Make sure you can restore without a working WordPress installation.
And test your recovery process before you actually need it.
Duplicator Cloud helps address these risks with off-site backup storage and browser-based recovery through an FTP or SFTP recovery connector.
You can initiate a restore from the Duplicator Cloud dashboard without a working WordPress installation or wp-admin access.
Because a backup isn't much use if you can't access it when things go wrong.
Your recovery plan should still work when your website doesn't.
Cope retweeted
Your website should do more than collect data. It should help you understand what’s working and alert you when something needs attention.
Most website owners only check their forms when they need to find a submission or troubleshoot a problem.
But what if your forms could tell you what happened last week without you having to log in?
The new WPForms Weekly Email Summary brings form analytics straight to your inbox every Monday.
You get a weekly overview of entries, views, spam blocked, and trends for individual forms. If a form that usually collects submissions suddenly goes quiet, the report flags it so you know where to investigate.
For sites accepting payments, it can also summarize payments, sales, and refunds.
There’s another useful addition: the Checkboxes field now supports an “Other” option, letting visitors provide answers you didn’t anticipate. Those responses carry through to entries, exports, and supported survey reports.
Both features are available on every plan, including WPForms Lite, with some analytics details reserved for paid plans.
The bigger idea is simple: your website should help you understand what is happening, not just collect data and wait for you to check it.
Link in the first comment.
Cope retweeted
Good automation doesn’t just save time. It helps you spot problems earlier and make better decisions with less manual work.
Most website owners only check their forms when they need to find a submission or troubleshoot a problem.
But what if your forms could tell you what happened last week without you having to log in?
The new WPForms Weekly Email Summary brings form analytics straight to your inbox every Monday.
You get a weekly overview of entries, views, spam blocked, and trends for individual forms. If a form that usually collects submissions suddenly goes quiet, the report flags it so you know where to investigate.
For sites accepting payments, it can also summarize payments, sales, and refunds.
There’s another useful addition: the Checkboxes field now supports an “Other” option, letting visitors provide answers you didn’t anticipate. Those responses carry through to entries, exports, and supported survey reports.
Both features are available on every plan, including WPForms Lite, with some analytics details reserved for paid plans.
The bigger idea is simple: your website should help you understand what is happening, not just collect data and wait for you to check it.
Link in the first comment.
Cope retweeted
Most website owners only check their forms when they need to find a submission or troubleshoot a problem.
But what if your forms could tell you what happened last week without you having to log in?
The new WPForms Weekly Email Summary brings form analytics straight to your inbox every Monday.
You get a weekly overview of entries, views, spam blocked, and trends for individual forms. If a form that usually collects submissions suddenly goes quiet, the report flags it so you know where to investigate.
For sites accepting payments, it can also summarize payments, sales, and refunds.
There’s another useful addition: the Checkboxes field now supports an “Other” option, letting visitors provide answers you didn’t anticipate. Those responses carry through to entries, exports, and supported survey reports.
Both features are available on every plan, including WPForms Lite, with some analytics details reserved for paid plans.
The bigger idea is simple: your website should help you understand what is happening, not just collect data and wait for you to check it.
Link in the first comment.
Cope retweeted
Congrats to @killa for solving the PHP2Shell Bitcoin challenge at stealmybitcoin.com.
The 0.02511679 BTC prize, worth $2,021.22 at the time, was claimed after just 19 hours and 28 minutes.
The winner has also published the PoC:
github.com/KillaBoi/StealMyB…
Challenge: stealmybitcoin.com
Someone has loaded a vulnerable PHP website with Bitcoin and challenged the internet to exploit the PHP2Shell vulnerabilities and steal it.
There’s a live timer tracking how long the Bitcoin survives.
stealmybitcoin.com
Cope retweeted
PHPの深刻な脆弱性を、実際の環境で検証する興味深い試み。理論上の危険性と、実際の悪用可能性の違いが見えてくるかもしれない。
Someone has loaded a vulnerable PHP website with Bitcoin and challenged the internet to exploit the PHP2Shell vulnerabilities and steal it.
There’s a live timer tracking how long the Bitcoin survives.
stealmybitcoin.com
Cope retweeted
約2,000ドル相当のビットコインを懸けたPHPのセキュリティチャレンジ。脆弱性の深刻度と、実環境での悪用可能性は別の問題だ。
Someone has loaded a vulnerable PHP website with Bitcoin and challenged the internet to exploit the PHP2Shell vulnerabilities and steal it.
There’s a live timer tracking how long the Bitcoin survives.
stealmybitcoin.com
約2,000ドル相当のビットコインを懸けたPHPのセキュリティチャレンジ。脆弱性の深刻度と、実環境での悪用可能性は別の問題だ。
Someone has loaded a vulnerable PHP website with Bitcoin and challenged the internet to exploit the PHP2Shell vulnerabilities and steal it.
There’s a live timer tracking how long the Bitcoin survives.
stealmybitcoin.com
PHPの深刻な脆弱性を、実際の環境で検証する興味深い試み。理論上の危険性と、実際の悪用可能性の違いが見えてくるかもしれない。
Someone has loaded a vulnerable PHP website with Bitcoin and challenged the internet to exploit the PHP2Shell vulnerabilities and steal it.
There’s a live timer tracking how long the Bitcoin survives.
stealmybitcoin.com
Cope retweeted
Someone has loaded a vulnerable PHP website with Bitcoin and challenged the internet to exploit the PHP2Shell vulnerabilities and steal it.
There’s a live timer tracking how long the Bitcoin survives.
stealmybitcoin.com
Cope retweeted
HTTPSだから安全とは限りません。Javaが信頼する証明書に問題があれば、暗号化された通信でも情報漏えいのリスクがあります。Javaの更新を確認し、修正を適用しましょう。
🚨 Oracle issued an emergency Java security update for CVE-2026-91403, a critical vulnerability rated CVSS 9.1.
The flaw affects Java’s certificate trust handling and could allow unauthenticated attackers to access or modify sensitive data.
Oracle’s fix blocks trust in affected eMudhra intermediate certificates.
If you run Java SE or GraalVM:
• Check your runtime versions.
• Apply the relevant security update.
• Verify bundled and server-side Java installations.
HTTPS is only as trustworthy as the certificates your software accepts.
Official advisory: oracle.com/security-alerts/a…
Cope retweeted
Google’s updated privacy policy introduces an important caveat.
If you connect Gmail, Drive or Photos to AI-powered Search, information and insights from that data may influence the ads you see.
Google says this is opt-in. Advertisers don’t get direct access to your private files.
The trade-off: more AI personalization, less separation between your personal data and advertising.