Insights

Cybersecurity & Web Security Blog

Cybersecurity insights, penetration-testing and compliance guides, threat research, and secure web development — from a team that breaks into systems for a living.

CVE-2026-78159: Comment-to-RCE in The Events Calendar

Sep 15, 2026 · 8 min read

CVE-2026-78159: Comment-to-RCE in The Events Calendar

CVE-2026-78159 turns a WordPress comment into remote code execution on sites running The Events Calendar ≤ 6.17.3. How the chain works, who is exposed, and what to do.

CVE-2026-9055: Unauthenticated Admin Takeover in the Amelia Booking Plugin

Sep 15, 2026 · 6 min read

CVE-2026-9055: Unauthenticated Admin Takeover in the Amelia Booking Plugin

CVE-2026-9055 is an unauthenticated privilege-escalation chain in Amelia Premium 8.0–9.6.2. How a booking customer becomes an administrator in two requests — and what to check.

CVE-2026-15748: Forminator Pre-Auth RCE on 600,000 Sites

Aug 22, 2026 · 6 min read

CVE-2026-15748: Forminator Pre-Auth RCE on 600,000 Sites

CVE-2026-15748 lets an unauthenticated attacker upload PHP to WordPress sites running Forminator. How the blocklist bypass works, who is actually exposed, and what to check.

CVE-2026-66583: Forminator's Second Critical Flaw in Three Weeks

Aug 22, 2026 · 5 min read

CVE-2026-66583: Forminator's Second Critical Flaw in Three Weeks

CVE-2026-66583 is an unauthenticated PHP object injection flaw in Forminator ≤ 1.57.0. What deserialization bugs actually do, and why patching once in July was not enough.

CVE-2026-18051: W3 Total Cache Arbitrary File Write, CVSS 10.0

Aug 22, 2026 · 5 min read

CVE-2026-18051: W3 Total Cache Arbitrary File Write, CVSS 10.0

CVE-2026-18051 lets unauthenticated attackers overwrite any existing file on servers running W3 Total Cache below 2.10.5 — including .htaccess. A public PoC is due 17 September.

CVE-2026-18391: Unauthenticated RCE in WooCommerce Subscriptions

Aug 22, 2026 · 5 min read

CVE-2026-18391: Unauthenticated RCE in WooCommerce Subscriptions

CVE-2026-18391 is an unauthenticated PHP object injection flaw in WooCommerce Subscriptions below 9.1.0, exploitable on stores using High-Performance Order Storage.

CVE-2026-19725: WPvivid Path Traversal — Why 9.1 Overstates It

Aug 22, 2026 · 5 min read

CVE-2026-19725: WPvivid Path Traversal — Why 9.1 Overstates It

CVE-2026-19725 is a path traversal flaw in WPvivid below 0.9.131. It scores 9.1, but the attacker controls only where the file lands — not what is in it. Here is what that actually means.

CVE-2026-61511: vBulletin Pre-Auth RCE, Exploit Now Public

Jul 28, 2026 · 8 min read

CVE-2026-61511: vBulletin Pre-Auth RCE, Exploit Now Public

Public exploit code now exists for CVE-2026-61511, an unauthenticated RCE in vBulletin's template engine. How it works, who is affected, what to do now.

wp2shell (CVE-2026-63030): WordPress Core Pre-Auth RCE

Jul 18, 2026 · 6 min read

wp2shell (CVE-2026-63030): WordPress Core Pre-Auth RCE

wp2shell (CVE-2026-63030 + CVE-2026-60137) is a pre-auth RCE in WordPress core's REST batch API. How the chain works, who's affected, and how to defend.

OT/ICS Security for Oil, Gas & Energy Operators

Jul 8, 2026 · 7 min read

OT/ICS Security for Oil, Gas & Energy Operators

A practical checklist for oil, gas and energy operators: SCADA penetration testing, NERC CIP compliance, IEC 62443 zoning, and Purdue Model segmentation.

APT Defense for Government Agencies & Contractors

Jul 8, 2026 · 7 min read

APT Defense for Government Agencies & Contractors

How government agencies and contractors can defend against APT and nation-state threats: detection, frameworks, red-teaming, and a practical checklist.

Git Hash Chain Malleability: A "Verified" Commit Isn't Unique

Jul 8, 2026 · 6 min read

Git Hash Chain Malleability: A "Verified" Commit Isn't Unique

New CMU research: a signed, "Verified" GitHub commit isn't unique. Attackers can forge a second valid commit with a different hash — here's what breaks.

Residential Proxy Botnet: How NetNut Powers Attacks

Jul 7, 2026 · 10 min read

Residential Proxy Botnet: How NetNut Powers Attacks

Google and the FBI dismantled NetNut, a 2-million-device residential proxy botnet built from hijacked smart TVs. How it worked, why it powers the attacks hitting your business, and how to defend.

Agentic AI Ransomware: Inside the JadePuffer Attack

Jul 6, 2026 · 10 min read

Agentic AI Ransomware: Inside the JadePuffer Attack

A technical breakdown of JadePuffer — the first documented agentic AI ransomware, where an LLM ran the whole intrusion. The real payloads, the 31-second self-fix, and how to defend.

Answer Engine Optimization (AEO) for Oman Business

Jul 3, 2026 · 9 min read

Answer Engine Optimization (AEO) for Oman Business

Answer Engine Optimization (AEO) helps your Oman business win Google featured snippets, "People Also Ask" and voice-search answers. Practical guide plus checklist.

Generative Engine Optimization (GEO) in Oman: 2026 Guide

Jul 1, 2026 · 8 min read

Generative Engine Optimization (GEO) in Oman: 2026 Guide

Learn generative engine optimization (GEO) for Oman: how to get your business recommended by ChatGPT, Gemini and AI search in 2026, with clear local steps.

Local SEO in Oman: Rank in 'Near Me' Searches

Jun 26, 2026 · 12 min read

Local SEO in Oman: Rank in 'Near Me' Searches

Local SEO in Oman: rank on Google for "near me" and city searches like "restaurant in Muscat" with a Google Business Profile, reviews, NAP and a fast mobile site.

Web Design in Oman 2026: Websites That Win Customers

Jun 19, 2026 · 9 min read

Web Design in Oman 2026: Websites That Win Customers

A practical 2026 guide to web design in Oman: what makes a website that wins customers, common mistakes, DIY vs pro, and real costs from OMR 100.

Small Business Website Essentials: 5 That Convert

Jun 16, 2026 · 6 min read

Small Business Website Essentials: 5 That Convert

The 5 small business website essentials that win customers in Oman: fast mobile design, a clear message, trust signals, easy WhatsApp contact and Google visibility.

Ecommerce in Oman: How to Launch an Online Store

Jun 9, 2026 · 4 min read

Ecommerce in Oman: How to Launch an Online Store

How to launch an online store in Oman in 2026: Thawani and OmanNet payments, a secure PCI-aware checkout, fast hosting, and Arabic-first UX that converts.

Website vs Instagram: Where Should Your Oman Business Start?

May 5, 2026 · 6 min read

Website vs Instagram: Where Should Your Oman Business Start?

Website vs Instagram for a new Omani business? Start on social to get seen fast, then build a simple website you actually own — for Google, payments and credibility. Here's the order.

Website Cost in Oman 2026: An Honest Price Guide

Apr 15, 2026 · 5 min read

Website Cost in Oman 2026: An Honest Price Guide

How much does a website cost in Oman in 2026? An honest breakdown of what actually drives the price — scope, design, bilingual Arabic, hosting and upkeep — in plain OMR terms.

Small Business Website in Oman: A Beginner's Guide

Mar 24, 2026 · 7 min read

Small Business Website in Oman: A Beginner's Guide

A beginner-friendly guide to building a small business website in Oman: domains (incl. .om), hosting, key pages, DIY vs hiring a developer, timeline and what actually works.

Penetration Testing in Oman: Do You Need It?

Mar 6, 2026 · 11 min read

Penetration Testing in Oman: Do You Need It?

Web application penetration testing in Oman: does your business need one, what PDPL, CBO and OCERT expect, how the test works and what the report contains.

Secure WordPress Website: The 2026 Hardening Checklist

Feb 5, 2026 · 2 min read

Secure WordPress Website: The 2026 Hardening Checklist

A practical checklist to build and maintain a secure WordPress website — hardening, plugins, updates, and testing — from a team of certified security experts.

Secure Web Development: What It Is & Why It Matters

Jan 27, 2026 · 3 min read

Secure Web Development: What It Is & Why It Matters

Secure web development builds protection into your site from day one. Learn what it means, why it matters, and how a security-first build protects your business.

Penetration Testing in 2026: Why Your Business Needs It

Jan 13, 2026 · 3 min read

Penetration Testing in 2026: Why Your Business Needs It

Your business is a target. Learn why automated scanners are not enough and why a professional penetration test from a certified team is essential in 2026.

WooCommerce Security: Build a PCI-Compliant Store

Jan 15, 2025 · 3 min read

WooCommerce Security: Build a PCI-Compliant Store

Protect revenue and customer data with a secure, PCI-compliant WooCommerce store. Learn the key risks and how to build an online store that's secure by design.

OWASP Top 10: Web App Security for Business Owners

Oct 8, 2024 · 3 min read

OWASP Top 10: Web App Security for Business Owners

A plain-English guide to web application security and the OWASP Top 10 — the most critical risks to your website and how a secure build prevents them.

Tutor LMS SQL Injection (CVE-2024-1751): Breakdown & Fix

Aug 14, 2024 · 2 min read

Tutor LMS SQL Injection (CVE-2024-1751): Breakdown & Fix

CVE-2024-1751 — our Principal Consultant discovered a high-severity (CVSS 8.8) SQL injection in Tutor LMS, a WordPress plugin used by over 80,000 websites.

Amelia Booking Reflected XSS: CVE Analysis & Fix

Mar 12, 2024 · 2 min read

Amelia Booking Reflected XSS: CVE Analysis & Fix

Our Principal Consultant discovered a reflected cross-site scripting vulnerability (CVE-2024-1484) in Amelia, a WordPress booking plugin used on 40,000+ sites.

WP Booking Calendar SQL Injection: CVE Breakdown

Feb 27, 2024 · 3 min read

WP Booking Calendar SQL Injection: CVE Breakdown

Our Principal Consultant discovered a critical unauthenticated SQL injection (CVE-2024-1207) in WP Booking Calendar, a WordPress plugin installed on 60,000+ sites.

Cybersecurity Blog: Threats, Pentesting & Security — IKZERO