Bleepingcomputer W3 Total Cache Plugin Vulnerability Exposes Over One Million WordPress Sites
Article Content
Browse articles 
A critical vulnerability, tracked as CVE-2025-9501, has been identified in the W3 Total Cache WordPress plugin, affecting all versions prior to 2.8.13. This flaw allows unauthenticated attackers to execute arbitrary PHP commands, potentially leading to full site takeovers for over one million installations. The developer has released a patch to address this security issue.
Ask AI about this cluster
Answers cite the sources they use
Updated 230d ago How this analysis works
More articles in this cluster (4)
Following this threat?
Track CVE-2025-9501 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
China-Linked Hackers Exploit PHP2Shell to Root 25 Servers Cybersecurity firm Dream reported that a China-linked threat actor exploited PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) and a Linux kernel privilege escalation flaw (CVE-2026-46300) to gain root access to 25 servers, including three in a U.S. government-affiliated environment. The attackers used… 
Brotli Decoder Vulnerability Patched Across Multiple Linux Distributions A vulnerability, CVE-2026-111497, affecting the Brotli decoder has been patched in various Linux distributions, including Fedora 44 and Oracle Linux 10. The flaw allows for an out-of-bounds write, which could potentially enable attackers to execute arbitrary code. The vulnerability was published on October 22, 2026…