post_content

28 Oct 2026 · @Dave Geoghegan

The short version

cPanel, the control panel behind many of our hosting plans, is raising its licence prices again. It is the eighth year in a row. From December 16, 2026 every cPanel licence tier costs roughly 8% to 10% more, and the charge for each extra account on a busy server goes up by over 12%.

We have absorbed most of these increases over the years, but we can no longer do that. From 1 November 2026 our cPanel hosting prices will go up.

There is a better option. Our DirectAdmin hosting runs on the same Dublin servers, gives you more storage, and costs less than cPanel. We will move you across for free, and we now recommend it for all our customers.

Who owns cPanel, and why prices keep rising

In August 2018 cPanel was bought by WebPros, a company backed by private equity firm Oakley Capital. WebPros already owned Plesk, the other big hosting control panel, and went on to buy WHMCS, the billing software most hosting companies use. In late 2019 a majority stake in WebPros was sold to CVC Capital Partners.

Within a year of the takeover, cPanel scrapped its simple per-server pricing and started charging by the number of hosted accounts. Since then prices have gone up every single year.

If that sounds familiar, it is the same playbook Broadcom used after buying VMware in November 2023. European cloud providers’ group CISPE reported VMware licence costs rising by 800% to 1,500% for many of its members. cPanel’s increases are nowhere near that bad, but the direction is the same: buy the software everyone depends on, then raise the price every year.

How cPanel prices have changed since 2019

These are cPanel’s own list prices per server, per month, in US dollars.

Effective	Solo (1 account)	Admin (5 accounts)	Pro (30 accounts)	Premier (100 accounts)	Each account over 100
Before mid 2019	$15	VPS: $20, unlimited accounts		Dedicated: $45, unlimited accounts	Free
Sept 2019	$15	$20	$30	$45	$0.20
Jan 2021	$15	$22	$32.25	$48.50	$0.30
Jan 2022	$15.99	$24.99	$35.99	$53.99	$0.34
Jan 2023	$15.99	$27.99	$39.99	$59.99	$0.39
Jan 2024	$17.49	$29.99	$42.99	$60.99	$0.40
Jan 2025	$26.99	$32.99	$46.99	$65.99	$0.45
Jan 2026	$29.99	$35.99	$53.99	$69.99	$0.49
Dec 16, 2026	$32.99	$38.99	$58.99	$76.99	$0.55

Since 2019 the Solo licence has more than doubled (up 120%), Admin and Pro have nearly doubled, Premier is up 71%, and the cost of each account over 100 has almost tripled (up 175%).

To put that in real terms: a server hosting 300 websites cost $45 a month to license in early 2019. From December it costs $186.99. That is more than four times as much for exactly the same software doing exactly the same job.

It is not just the licence

WebPros has also added new charges alongside the headline licence price:

• Older operating system fees. Servers still running CentOS 7 or CloudLinux 7 now pay a monthly Extended Lifecycle Support fee on top of the licence, extended through the end of 2027.
• Add-on increases. The security and performance tools we run on every cPanel server, such as CloudLinux, Imunify360 and KernelCare, are also going up from December 16.
• WHMCS and Plesk. Our billing platform (WHMCS) and the Plesk control panel, both owned by the same group, rise by up to 20% in 2027.

Where prices are likely heading

Nobody outside WebPros knows future prices for certain. But the pattern since 2019 is steady: an increase every year, averaging roughly 9% to 10% on the main tiers and well over 10% on the per-account charge. If that continues, this is roughly where list prices will land:

Year (estimate)	Solo	Admin	Pro	Premier	Each account over 100
2027 (confirmed)	$32.99	$38.99	$58.99	$76.99	$0.55
2028	~$36	~$42.50	~$64	~$84	~$0.61
2029	~$39	~$46	~$70	~$91	~$0.68
2030	~$43	~$50	~$76	~$100	~$0.75

Estimates assume 9% a year on licence tiers and 11% a year on the per-account charge. They are our projection, not cPanel’s.

On that path, a 100-account cPanel server will cost around $100 a month to license by 2030, more than double what it cost in 2019.

What this means for WebWorld customers

We buy cPanel licences in US dollars for every server we run, then pay again for the add-ons that keep your sites fast and secure. When those costs rise every year, we eventually have to adjust our prices.

From 1 November 2026, our cPanel hosting plans will be priced as follows (excluding VAT):

Plan	Current monthly	New monthly	Current yearly	New yearly
Europa	€9.95	€10.95	€109.45	€120.45
Callisto	€14.95	€15.95	€164.45	€175.45
Ganymede	€19.95	€21.95	€219.45	€241.45
Titan	€24.95	€27.95	€274.45	€307.45

If you are on an annual plan, your current price stays in place until your next renewal.

For VPS and dedicated servers where you pay for a cPanel licence directly, the licence charge will move in line with cPanel’s new list price from your next invoice after December 16, 2026.

Even after this change, our plans remain competitive with other Irish hosts, and you still get your site hosted in our own Dublin data centres, on our own network, with support from people in Dublin.

Our recommendation: move to DirectAdmin

DirectAdmin is a control panel that does the same everyday jobs as cPanel: email accounts, file manager, databases, SSL certificates and one-click WordPress installs through Softaculous. It runs in the same Dublin data centres, on the same network, with the same support team. Its licence costs a fraction of cPanel’s, and we pass that saving on to you.

Every cPanel plan has a DirectAdmin equivalent that hosts the same number of websites, with more storage, for less money:

Your cPanel plan	New cPanel price	DirectAdmin plan	DirectAdmin price	You save	Storage	Monthly transfer
Europa (5 sites)	€10.95	Atlas (5 sites)	€4.95	€6.00 a month	10GB → 25GB	100GB → 100GB
Callisto (50 sites)	€15.95	Prometheus (50 sites)	€9.95	€6.00 a month	25GB → 50GB	500GB → 200GB
Ganymede (100 sites)	€21.95	Phoebe (100 sites)	€15.95	€6.00 a month	35GB → 100GB	750GB → 500GB
Titan (150 sites)	€27.95	Triton (150 sites)	€19.95	€8.00 a month	50GB → 200GB	1TB → 1TB

Monthly prices, excluding VAT. Even at today’s cPanel prices, DirectAdmin works out €4 to €5 a month cheaper on every plan.

How the free move works

1. Open a support ticket or reply to our email asking to move to DirectAdmin.
2. Our Dublin team copies your website, databases and email accounts to your new DirectAdmin plan.
3. You check everything on the new server before anything changes.
4. We switch your DNS only when you are happy. Your website address and email addresses stay the same.
5. Your bill drops to the DirectAdmin price from your next invoice. Unused credit from your cPanel plan will be deducted from your first DirectAdmin invoice.

Most moves are done within 24 hours, with no downtime.

Prefer to stay on cPanel?

That is fine. Your plan carries on as normal at the new price from 1 November 2026, and you do not need to do anything.

If you have a VPS or dedicated server with its own cPanel licence, talk to us. A DirectAdmin or Plesk licence can work out considerably cheaper, especially on servers with many accounts.

Questions?

Ready to move, or not sure which plan is right for you? Open a support ticket or call us on +353 1 495 1112. We will look at your account and recommend the right DirectAdmin plan.

Sources: cPanel pricing announcements and industry coverage of the 2019 to 2027 price changes. Prices in US dollars are cPanel list prices excluding tax.

From 1 November 2026, the price of .com, .net and .org domain registrations, renewals and transfers at Web World will increase by €2.00 per year.

Domain	Current price (per year)	From 01/11/2026 (per year)
.com	€18.95	€20.95
.net	€18.95	€20.95
.org	€18.95	€20.95

The new price applies on your domain’s next renewal date on or after 1 November 2026. Renewing for several years before then locks in the current price for every year you add.

Why prices are going up

Every domain extension is run by a registry, which charges every registrar, including us, a fixed wholesale price for each year a domain is registered. When the registry raises that price, every registrar in the world pays more.

This year all three registries have raised their prices:

• .com: Verisign, which runs .com, is raising its price by 6.9% on 1 November 2026. (Domain Name Wire)
• .net: Verisign is raising the .net price by 10% on 1 March 2027. (Verisign)
• .org: Public Interest Registry raised the .org price by about 11% on 1 June 2026, its first increase since 2016. (Domain Name Wire)

ICANN also charges a fee on every domain. All of these costs are billed to us in US dollars, so exchange rate movements also affect what we pay in euro.

Web World (IANA 3957) is an ICANN accredited registrar, so these wholesale prices apply to us directly.

.com prices over the years

Since the price freeze ended in 2021, Verisign has raised the .com price at every opportunity its contract allows.

Expect more increases

These rises are built into the registries’ contracts, so we expect them to continue.

• .com: Verisign’s agreement with ICANN and the US government lets it raise the price by up to 7% in four out of every six years. A new four-year window has just opened, and Verisign has taken every increase it was allowed since 2021. If that continues, the .com price could rise by more than 20% again by 2030. (OSIR)
• .net: Verisign may raise the .net price by up to 10% every year, and has used close to the full 10% each time since 2012.
• .org: ICANN removed the price cap on .org in 2019, so future increases are set by the registry.

Our own .com price tells the same story: €10.00 in 2021, rising to €20.95 from this November.

Lock in today’s price

The best way to protect yourself from future increases is to renew for several years at once. You pay today’s price for every year you add, so increases announced in the meantime will not affect you until those years run out.

Renew before 1 November 2026 and every year is charged at €18.95 instead of €20.95. For example, renewing a .com for 5 years now costs €94.75, compared with at least €104.75 at the new price, and more if prices keep rising as expected.

Most domains can be renewed for up to 10 years in total. Log in to your client area to extend your renewal, or contact us and we’ll do it for you.

If you have any questions, or would like help renewing, please get in touch with our team.

Quick Summary

🟢 WebWorld customers: If you have a managed service or shared hosting account with WebWorld, we will patch this for you automatically. No action required – we’re handling it.

• What: CVE-2026-109618 and CVE-2026-109619 – critical PHP vulnerabilities enabling Remote Code Execution (CVSS 9.2/10)
• Who: ALL PHP versions from 5.4 through current 8.5 are vulnerable
• Fixed versions: PHP 8.5.12+, 8.4.27+, 8.3.36+, and 8.2.35+ contain patches. PHP 5.4-8.1 have no upstream patch.
• Risk Level: CRITICAL – allows unauthenticated remote code execution
• Time to fix: For supported versions: update PHP and restart. For EOL versions: apply workaround (5-10 minutes)

Risk Assessment Matrix

Scenario	Risk Level	Action Required
PHP 8.2-8.5 (any configuration)	🔴 CRITICAL	Update PHP TODAY to fixed version + restart
PHP 5.4-8.1 with file uploads	🔴 CRITICAL	Apply workaround TODAY or update PHP
PHP 5.4-8.1 (no file uploads)	🟠 HIGH	Apply workaround this week
Any PHP version, patched and restarted	✅ MITIGATED	Maintain baseline security; monitor for updates

The Vulnerability

On October 21, 2026, the PHP project released emergency patches for two critical vulnerabilities affecting the Zend Engine. Known publicly as CVE-2026-109618 and CVE-2026-109619, these flaws allow unauthenticated remote attackers to achieve Remote Code Execution (RCE) on any affected PHP installation.

What Each CVE Does

• CVE-2026-109618 (Out-of-Memory Corruption): PHP can mishandle memory when a request causes it to run out of memory, allowing an attacker to corrupt memory and execute code.
• CVE-2026-109619 (Stale Worker State): A PHP process can keep using data from a completed request after it should have been discarded. A later request handled by the same PHP process can use that stale data to execute code.

Both vulnerabilities can be exploited without authentication – any web visitor can potentially trigger them. A successful attacker gains access equivalent to the web server process: they can read files, access database credentials, steal data, or install a persistent backdoor.

How to Fix: Two Paths

Path A: If You’re Running PHP 8.2-8.5 (Supported Versions)

UPDATE PHP IMMEDIATELY. Security patches are available and should be installed at your earliest opportunity.

• Minimum fixed versions: PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35
• Linux distributions: Check your vendor (Ubuntu, CentOS, Debian, etc.) for updated packages – they may have backported the fix to older version numbers
• After updating: You MUST restart PHP for the fix to take effect. All running PHP processes must use the new code.

Restart PHP After Updating

Update alone is not enough – restart your PHP service:

systemctl restart php-fpm* 2>/dev/null || systemctl restart php*-fpm 2>/dev/null
systemctl restart httpd 2>/dev/null || systemctl restart apache2 2>/dev/null
systemctl restart nginx 2>/dev/null

If you use Docker or containers, rebuild and redeploy from an updated base image.

Verify the update worked by checking your WordPress site – go to Tools - Site Health - Info - Server and confirm the PHP version shows 8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+.

Path B: If You’re Running PHP 5.4-8.1 (EOL Versions – No Patch Available)

These PHP branches are End-of-Life and will not receive upstream patches. You have two options:

Option B1: Upgrade to PHP 8.2+ (Recommended)

Contact your hosting provider and request an upgrade to PHP 8.2 or newer. Most modern hosting supports this. After upgrading, follow Path A above (restart PHP and verify the update).

Option B2: Apply the Workaround (Temporary, While Upgrading)

The primary attack vector exploits PHP’s internal session upload progress mechanism. Disabling this feature blocks the main attack path without requiring a full upgrade – though it does not provide complete protection.

session.upload_progress.enabled = Off

Will this break websites? Over 99% of modern websites do not use this feature. WordPress, modern CMS engines, and JavaScript frameworks handle upload progress via client-side browser APIs (XMLHttpRequest or fetch), entirely independent of PHP’s internal session tracker.

In the rare event that a legacy application depends on server-side upload tracking, the site will need to be upgraded to PHP 8.2+ or newer. There is no secure alternative for EOL runtimes.

Step-by-Step Workaround: Disabling Session Upload Progress

This is the temporary mitigation for PHP 5.4-8.1. If you’re on PHP 8.2+, see Path A above.

On Linux (Apache / NGINX / PHP-FPM)

Step 1: Find all php.ini files

Run this command as root to locate all active PHP configuration files:

find /etc /usr/local -name "php.ini" 2>/dev/null

Step 2: Apply the fix to all files

Update or add the setting automatically using sed:

find /etc /usr/local -name "php.ini" -exec sed -i 's/^;*session.upload_progress.enabled\s*=.*/session.upload_progress.enabled = Off/' {} +

If the setting doesn’t exist in older configs, append it:

find /etc /usr/local -name "php.ini" -exec sh -c 'grep -q "^session.upload_progress.enabled" "$1" || echo "session.upload_progress.enabled = Off" >> "$1"' _ {} \;

Step 3: Restart web services

For systemd-based distributions (CentOS, AlmaLinux, RHEL, Debian, Ubuntu):

systemctl restart php-fpm* 2>/dev/null || systemctl restart php*-fpm 2>/dev/null
systemctl restart httpd 2>/dev/null || systemctl restart apache2 2>/dev/null
systemctl restart nginx 2>/dev/null

On Windows (IIS / Apache)

Step 1: Locate all php.ini files

Open an elevated Command Prompt and search your drives:

dir C:\php.ini /s /b /a:-d
dir D:\php.ini /s /b /a:-d

Alternatively, using PowerShell:

Get-ChildItem -Path C:\, D:\ -Filter "php.ini" -File -Recurse -ErrorAction SilentlyContinue | Select-Object -ExpandProperty FullName

Step 2: Edit php.ini files

For each file found:

• Open in Notepad (right-click – Edit as Administrator)
• Find the [Session] section
• Locate or add the line: session.upload_progress.enabled = Off
• Ensure there is no semicolon ; at the beginning
• Save the file

Step 3: Restart web services

For IIS, run in elevated Command Prompt:

iisreset

For Apache on Windows, restart the Apache service via Services (services.msc) or Command Prompt:

net stop Apache2.4
net start Apache2.4

Verification

Check your WordPress PHP version: Go to Tools - Site Health - Info - Server and note the PHP version displayed.

For Updated PHP (8.2.35+, 8.3.36+, 8.4.27+, or 8.5.12+):

If Site Health shows one of these versions (or higher), your server is patched and secure. No further action needed.

For the Workaround (EOL PHP versions):

To verify the workaround is active, run:

php -i | grep -i "session.upload_progress.enabled"

On Windows, use:

php -i | findstr /i "session.upload_progress.enabled"

The output should show:

session.upload_progress.enabled => Off => Off

Important Notes

• This is a PHP vulnerability, not a WordPress issue. Updating WordPress does not install PHP patches. Your hosting provider controls PHP on shared and managed hosting.
• Restarting PHP is critical. Updating the package alone won’t protect you if the old processes are still running. Always restart the service.
• The workaround is temporary. It blocks the primary attack vector but does not provide complete protection. Plan to upgrade to supported PHP as soon as possible.
• Public exploits are circulating. Apply fixes as soon as possible. Do not wait to see if an attack targets your specific setup.
• Preserve logs: As a precaution, retain web server, PHP, and system logs covering at least 48 hours before October 21 through when PHP was patched and restarted. This helps detect any attempted exploitation.

Next Steps

• PHP 8.2-8.5 users: Update PHP today and restart the service. Verify the version in WordPress Site Health.
• PHP 5.4-8.1 users: Apply the workaround immediately, or contact your host about upgrading to PHP 8.2+.
• WebWorld customers: We are handling this automatically. No action needed on your part.
• Shared hosting customers (other providers): Contact your host and ask: “Are both CVE-2026-109618 and CVE-2026-109619 patched, and has PHP been restarted?”

What You Need to Know

On Friday, July 17, 2026, the WordPress Security Team released emergency security updates for WordPress Core addressing two vulnerabilities that, when chained together, allow unauthenticated remote code execution. The chain, now widely known as wp2shell, is the first critical unauthenticated RCE in WordPress Core in nearly a decade.

If you run a WordPress site, this one matters. Exploitation does not require a vulnerable plugin, a vulnerable theme, or a logged-in attacker. A vulnerable WordPress installation exposed to the public internet is enough.

The short version

wp2shell chains two separate vulnerabilities in WordPress Core:

• CVE-2026-60137 – an unauthenticated SQL injection issue involving the author__not_in query parameter.
• CVE-2026-63030 – a REST API batch request route-confusion issue that can be chained with the SQL injection to achieve remote code execution.

The chain was discovered and responsibly disclosed by Adam Kues of Assetnote / Searchlight Cyber. His technical writeup explains how the batch API validation and execution paths could be desynchronised, allowing attacker-controlled parameters to reach a route that would normally sanitise them. From there, the SQL injection can be leveraged through WordPress post caching, oEmbed cache rows, changesets, and action hooks to create a rogue administrator account and execute code through normal admin capabilities, such as uploading a plugin.

In practical terms: successful exploitation gives an attacker full administrative control of your WordPress site and the ability to execute code with the privileges of the web server.

What is remote code execution?

Remote code execution (RCE) means an attacker can run their own code on your website’s server, from anywhere in the world, without needing a username or password. In plain English: a stranger can take control of your website without ever logging in.

RCE is the most serious category of web vulnerability. It is not just someone defacing your homepage – it is someone being able to install malware, steal your customer data, send spam from your domain, or use your server to attack other websites.

Who is affected

The affected versions differ slightly between the two vulnerabilities:

• WordPress 6.9.x – affected by both vulnerabilities. Patched in 6.9.5.
• WordPress 7.0.x – affected by both vulnerabilities. Patched in 7.0.2.
• WordPress 6.8.x – affected by the SQL injection only. Patched in 6.8.6.
• WordPress 6.7 and earlier – not affected.

Because 6.8.x is not exposed to the REST API route-confusion issue, it is not vulnerable to the full RCE chain – but it should still be updated promptly to address the SQL injection.

If your site runs WordPress 6.8.x, 6.9.x, or 7.0.x, confirm immediately that it has updated to the appropriate patched version.

Why didn’t my site update automatically?

WordPress enabled forced automatic updates for this release because of its severity. In theory, that means most sites should have patched themselves within hours of the July 17 release. In practice, many sites did not. Common reasons include:

• Automatic updates disabled in wp-config.php – a developer may have added define( 'AUTOMATIC_UPDATER_DISABLED', true ); at some point.
• A plugin is blocking updates – some “update manager” or security plugins override WordPress’s default update behaviour.
• Managed hosting settings – some hosts delay or gate core updates behind their own testing process.
• File permission problems – if WordPress cannot write to its own files, the update silently fails.
• The site is pinned to an older branch – sites on 6.8.x only receive the 6.8.6 update, not 7.0.2.

Do not assume your site patched itself just because WordPress said it would. Log in and check the version number. It takes ten seconds.

How quickly this is being exploited

This is the part that should worry you. According to Wordfence’s telemetry (all times IST):

• July 17, 2026 – WordPress releases patched versions 6.8.6, 6.9.5, and 7.0.2. Forced automatic updates are enabled due to severity.
• July 18, 00:29 IST – First exploit-shaped probing observed against the REST API batch endpoint.
• July 18, 00:42 IST – First clear SQL injection attempt observed.
• July 18-19 – Proof-of-concept exploit code and independent reproductions begin circulating publicly.
• July 20 – Searchlight Cyber publishes Adam Kues’ full technical writeup, along with a public checker at wp2shell.com.

Exploitation activity began within hours of the patch release. Sites that did not update promptly were exposed while public technical details were circulating and attackers were already probing for vulnerable installations.

How to update WordPress

Before you update: make sure you have a recent backup of your site. Most hosting control panels include a one-click backup tool, and the update itself is very safe – but if anything does go wrong, a backup means you can roll back in minutes rather than rebuilding from scratch. If you are not sure how to take a backup, ask us before proceeding.

There are three ways to get your WordPress site updated:

1. Contact your web designer. If someone built or maintains your site, they should be your first call. Ask them to confirm your WordPress Core version and update to 6.8.6, 6.9.5, or 7.0.2 as appropriate.
2. Update WordPress via your hosting control panel. Most hosting plans include a one-click WordPress updater. Log in to your hosting control panel, find the WordPress or Softaculous section, and run the update from there. Alternatively, log in to your WordPress admin area and go to Dashboard → Updates.
3. Contact us and we will update WordPress for you. If you would like WebWorld to handle the update, open a support ticket and we will take care of it. This is a paid service – we will confirm the cost with you before any work begins.

How do I know if I’ve already been hacked?

This is the question most people ask after reading about a vulnerability like this. Here are the warning signs to look for:

• Unfamiliar administrator accounts – in wp-admin, go to Users → All Users and check every account with the Administrator role. If you see one you did not create, treat the site as compromised.
• Plugins or themes you did not install – check Plugins → Installed Plugins and Appearance → Themes for anything new.
• Unexpected posts, pages, or spam links – especially pharmaceutical, gambling, or crypto content you did not write.
• Changed files – if you have a file-integrity plugin (Wordfence, Solid Security, etc.), review its scan results for modified core files.
• Google Search Console warnings – “This site may be hacked” or “Deceptive site ahead” notices.
• Sudden traffic spikes or strange outbound traffic – your hosting control panel’s bandwidth graphs can show this.
• Visitors reporting browser warnings – red “dangerous site” interstitials from Chrome or Firefox.

You can also run your site through the public checker at wp2shell.com to confirm whether it is still vulnerable.

If any of the above looks familiar, do not just patch and move on. Patching closes the door, but it does not remove an attacker who is already inside. A compromised site needs to be professionally cleaned – contact us or your web designer immediately.

After updating: what to check

Once your site is patched, take a few minutes to verify everything is clean:

1. Confirm the update completed successfully. Check the version number in the bottom-right corner of wp-admin, or go to Dashboard → Updates.
2. Review administrator accounts for any unexpected users (Users → All Users).
3. Review recent plugin uploads and file changes for anything you did not authorise.
4. Check your site with the public checker at wp2shell.com.
5. If you have Wordfence installed, review firewall logs for blocked requests to /wp-json/batch/v1 or ?rest_route=/batch/v1.

Because the impact can include administrator creation and code execution, any suspected exploitation should be treated as a potential full site compromise. If you find anything suspicious, contact us or your web designer immediately.

What happens if I do nothing?

If your site stays unpatched, the realistic outcomes over the coming weeks are:

• Site defacement or malware installation – your homepage replaced, or malicious scripts injected into every page.
• Your site used to attack others – compromised sites are routinely used to send spam, host phishing pages, or launch attacks on other servers. Your domain’s reputation goes with it.
• Blacklisting by Google – once Google detects malware, your site is flagged in search results and browsers show a red warning screen to visitors. Getting removed from the blacklist takes days to weeks after cleanup.
• SEO damage – spam content and blacklisting can undo years of search ranking work.
• Customer data theft – if your site stores any personal data (contact forms, orders, accounts), a breach may be a notifiable incident under GDPR. That means reporting to the Data Protection Commission within 72 hours and potentially notifying affected customers. The reputational and regulatory cost of that dwarfs the cost of an update.

Updating takes minutes. Recovering from a compromise takes days, and the consequences can follow your business for months.

The bottom line

wp2shell is one of the most significant WordPress Core security events in recent years. The combination of unauthenticated reachability, no plugin or theme requirement, a massive global attack surface, a path to administrator access and code execution, and publicly available proof-of-concept code makes this vulnerability chain unusually serious.

The WordPress Security Team moved quickly to release patched versions, but public exploit activity began within hours. Patching remains the single most important step you can take.

If you have not already confirmed that your site is running a patched WordPress version, do that now.

WebWorld is proud to announce that we have been awarded .ie Gold Partner status, an official accreditation granted by the .ie Domain Registry, recognising excellence, trust, and leadership in Ireland’s domain and hosting industry.

This achievement reflects our long-standing commitment to helping Irish businesses, organisations, and entrepreneurs build a secure and successful online presence.

What Being a .ie Gold Partner Means

As a .ie Gold Partner, Web World has met the highest standards set by the .ie Domain Registry. This accreditation is awarded only to providers who demonstrate:

• Expert knowledge of .ie domains
• Exceptional customer service and support
• Proven reliability in domain management
• Strong commitment to Ireland’s digital identity

For our customers, this means you’re working with a partner who is officially recognised for quality, trust, and expertise.

Why This Matters for Your Business

Choosing a .ie domain is choosing an online identity rooted in Ireland — trusted by Irish consumers and recognised globally. As a Gold Partner, Web World can offer:

• Faster, smoother .ie registrations
• Expert guidance on choosing and securing your domain
• Priority access to updates, policies, and best practices from the .ie Registry
• Enhanced security and compliance for your online presence

Your domain is the foundation of your digital brand. With Web World, you’re backed by one of Ireland’s most trusted accredited providers.

Strengthening Ireland’s Digital Future

This accreditation reinforces our mission: to support Irish businesses with world‑class hosting, domain services, and digital infrastructure. Whether you’re launching a new venture, expanding your brand, or upgrading your online presence, Web World is here to help you grow with confidence.

If you’d like help choosing the right domain or improving your online setup, you can contact us directly by emailing sales@webworld.ie

For many years, email forwarding was considered a simple and convenient way to manage business communications. Companies could create professional email addresses such as info@yourcompany.com and automatically forward incoming messages to a Gmail, Outlook, or Yahoo inbox.

While this setup worked well in the past, it is becoming increasingly unreliable. Businesses are reporting missing emails, messages landing in spam folders, and important communications that never reach their intended recipients.

At Web World, we regularly help clients troubleshoot email delivery issues, and one common factor continues to emerge: traditional email forwarding is no longer the dependable solution it once was.

What Changed?

The email landscape has evolved significantly over the last few years. Major providers such as Gmail, Microsoft Outlook, and Yahoo have strengthened their security requirements to combat spam, phishing attacks, and email spoofing.

As a result, email authentication protocols now play a critical role in determining whether a message is delivered successfully.

The three most important authentication standards are:

• SPF (Sender Policy Framework)
• DKIM (DomainKeys Identified Mail)
• DMARC (Domain-based Message Authentication, Reporting and Conformance)

These technologies help receiving mail servers verify that an email is genuinely sent by the domain it claims to represent.

Why Email Forwarding Causes Problems

When an email is forwarded, it passes through an additional mail server before reaching its final destination.

Although the message itself may be legitimate, the forwarding process can interfere with modern authentication checks.

SPF Failures

SPF records specify which servers are authorized to send email on behalf of a domain.

When a forwarded email arrives at Gmail or another provider, the receiving server may see the forwarding server—not the original sender—as the source of the message.

This can cause SPF validation to fail, making the email appear suspicious even though it originated from a trusted sender.

DKIM and Message Integrity

DKIM adds a digital signature to outgoing messages.

During the forwarding process, certain email headers may be modified. Even minor changes can sometimes affect the validation of the DKIM signature.

If both SPF and DKIM checks fail, the receiving server may reject the message entirely based on the sender’s DMARC policy.

Stricter Policies from Major Providers

Recent updates from Google and Yahoo have introduced stricter requirements for email authentication, especially for domains sending large volumes of email.

While these changes improve overall email security, they also expose weaknesses in older forwarding-based setups that many businesses still rely on.

The Risks for Businesses

Email delivery problems can have serious consequences.

A missed email could mean:

• Losing a potential customer inquiry
• Missing a quote request
• Delaying support responses
• Disrupting communication with suppliers or partners
• Damaging customer trust

The most concerning aspect is that these failures often happen silently. Neither the sender nor the recipient may realize that a message was blocked or discarded.

Better Alternatives to Email Forwarding

1. Use Direct Mailbox Access

Instead of forwarding messages, consider accessing your business mailbox directly through webmail, desktop email clients, or mobile applications.

This approach preserves the original authentication chain and significantly improves delivery reliability.

2. Connect Your Mailbox to Gmail or Outlook via POP3 or IMAP

Many businesses prefer using Gmail or Outlook as their primary interface. Rather than forwarding messages, these platforms can retrieve email directly from your hosting account using POP3 or IMAP.

This method avoids many of the authentication issues associated with traditional forwarding.

3. Upgrade to a Professional Email Platform

Solutions such as Google Workspace and Microsoft 365 provide enterprise-grade email infrastructure, advanced security features, and improved deliverability.

For businesses that rely heavily on email communication, these platforms often provide the most reliable long-term solution.

4. Review Your Email Authentication Settings

Properly configured SPF, DKIM, and DMARC records are essential for modern email communication.

Regular audits of your domain’s email configuration can help identify issues before they impact business operations.

How Web World Can Help

Email systems have become far more complex than they were a decade ago. What worked perfectly in the past may now create hidden delivery problems that affect your business every day.

At Web World, we help businesses review their email infrastructure, improve email authentication, and implement modern solutions that ensure important messages reach their destination.

Whether you are experiencing delivery issues or simply want to future-proof your email setup, our team can help you choose the right solution for your business.

Final Thoughts

Email forwarding remains a convenient feature, but it should no longer be viewed as a guaranteed method of email delivery.

As email providers continue to strengthen security standards, businesses need to adapt by implementing modern email practices and authentication methods.

Taking action now can help prevent missed opportunities, improve communication reliability, and ensure your business remains connected to customers when it matters most.

Dirty Frag (CVE-2026-43284): What you need to know.

On May 8, 2026, the Linux kernel project assigned CVE-2026-43284 to a vulnerability now being discussed publicly as Dirty Frag. Early public discussion describes it as a potentially broad Linux local privilege escalation issue, but the official NVD entry is more precise: the bug sits in the Linux kernel networking stack, specifically around ESP-in-UDP handling, splice-backed packet buffers, and shared skb fragments.

At the time of writing, NVD has published the record but has not yet assigned a CVSS score. Even so, kernel and security teams should treat this as a patch-priority issue because it involves kernel memory ownership assumptions and in-place modification of packet data.

The short version

Dirty Frag is caused by a mismatch in how the Linux kernel marks packet buffers that contain pages spliced from a pipe.

TCP already marks these buffers with SKBFL_SHARED_FRAG, warning later code that the skb contains shared fragments and must be copied before modification. Some IPv4 and IPv6 UDP datagram paths did not set the same flag when using MSG_SPLICE_PAGES.

That matters because ESP input processing can decrypt packet data in place. If an ESP-in-UDP packet is backed by shared pipe pages but is not marked as shared, the kernel may treat it like privately owned skb data and modify it directly.

In plain English: the kernel could decrypt into memory it did not privately own.

Why this is risky

Kernel networking code relies heavily on ownership rules: before modifying packet data, code needs to know whether the memory is private or shared. If that bookkeeping is wrong, security boundaries can start to blur.

The official NVD description says the vulnerable path leaves an ESP-in-UDP packet made from shared pipe pages “looking like an ordinary uncloned nonlinear skb.” ESP input then takes a fast path that avoids copy-on-write and decrypts in place.

That is the heart of Dirty Frag:

• MSG_SPLICE_PAGES can attach pipe-backed pages directly to an skb.
• TCP correctly marks these as shared fragments.
• IPv4/IPv6 UDP datagram splice paths did not.
• ESP input could therefore skip copy-on-write.
• Packet data could be modified in-place even though the skb did not privately own the backing pages.

What was fixed

The Linux kernel fix does two things:

1. Marks IPv4/IPv6 datagram splice fragments with SKBFL_SHARED_FRAG, matching TCP behavior.
2. Makes ESP input fall back to skb_cow_data() when that flag is present, ensuring ESP does not decrypt externally backed fragments in place.

The NVD description also notes that ESP output was intentionally left unchanged because the problematic trailer-appending path is not reachable for nonlinear skbs in the same way.

Who should care

Prioritize investigation if you run:

• Linux systems with untrusted local users
• multi-tenant Linux environments
• container or Kubernetes hosts where local kernel attack surface matters
• systems using IPsec / ESP-in-UDP paths
• environments that allow workloads to exercise advanced networking APIs

Even if exploitation requirements turn out to be narrower than early “universal LPE” language suggests, this is still kernel-space memory ownership logic. That puts it in the category of issues defenders should not ignore.

Detection and response

There is no simple log line that proves exploitation from normal system logs. Response should focus on exposure reduction and patch verification.

Recommended steps:

1. Track vendor advisories for your distribution or kernel provider.
2. Patch to a kernel containing the Dirty Frag fix as soon as packages are available.
3. Prioritize shared and multi-user systems before single-user endpoints.
4. Review workloads that rely on IPsec, UDP encapsulation, or high-performance splice/send paths.
5. Limit untrusted local code execution where patching is delayed.
6. Reboot after kernel updates unless your live-patching provider explicitly confirms coverage.

Current status

• CVE: CVE-2026-43284
• Nickname: Dirty Frag
• Affected component: Linux kernel networking stack, ESP/UDP skb fragment handling
• Published: May 8, 2026
• CVSS: Not yet provided by NVD at time of writing
• Fix direction: Mark UDP splice fragments as shared and require copy-on-write before ESP in-place decrypt

References

• NVD: CVE-2026-43284
• Openwall oss-security discussion: “Dirty Frag: Universal Linux LPE”
• Linux stable kernel commits referenced by NVD

How to fix Dirty Frag CVE-2026-43284

Customers should treat Dirty Frag as a kernel update issue. The safest fix is to install a Linux kernel version that includes the upstream patches for CVE-2026-43284.

1. Check whether your system is affected

First, check the running kernel version:Copy

uname -r

Then compare it against your Linux vendor’s advisory for CVE-2026-43284.

Affected status depends on the kernel version and whether your distribution has already backported the fix.

2. Update the kernel

Install the latest kernel updates from your distribution.

For Debian or Ubuntu-based systems:Copy

sudo apt update
sudo apt upgrade

For AlmaLinux, RHEL, CentOS Stream or Rocky Linux: Copy

sudo dnf update kernel

For older RHEL/CentOS systems:Copy

sudo yum update kernel

For SUSE-based systems:Copy

sudo zypper update kernel-default

For Arch Linux:Copy

sudo pacman -Syu

3. Reboot into the patched kernel

Kernel updates usually do not fully take effect until the system has rebooted.Copy

sudo reboot

After rebooting, confirm the active kernel:Copy

uname -r

Make sure the running kernel is the updated version, not the old vulnerable one.

4. Prioritize exposed or multi-user systems

Patch these systems first:

• shared hosting servers
• Kubernetes and container hosts
• VPN/IPsec gateways
• systems with untrusted local users
• developer workstations running untrusted code
• internet-facing Linux infrastructure

5. If you cannot patch immediately

If an immediate kernel update is not possible, reduce exposure until patching can be completed:

• restrict untrusted local shell access
• avoid running untrusted containers or workloads
• limit access to systems using IPsec or ESP-in-UDP where possible
• apply vendor-recommended mitigations if provided
• monitor distribution security advisories for temporary workarounds

These mitigations should be treated as temporary. They are not a replacement for patching.

6. Verify with your vendor

Because many enterprise Linux vendors backport security fixes without changing the major kernel version, do not rely only on upstream kernel version numbers.

Check the advisory from your OS vendor, for example:

• Ubuntu Security Notices
• Debian Security Advisories
• Red Hat CVE database
• SUSE Security Advisories
• Amazon Linux Security Center
• Oracle Linux Errata
• distro-specific kernel changelogs

Bottom line

Dirty Frag is a reminder that small ownership flags in kernel networking code can carry big security consequences. The bug is not about flashy malware or a misconfigured service; it is about whether the kernel knows it owns the memory it is about to modify.

For defenders, the action is straightforward: watch your vendor advisory feed, patch affected kernels, reboot, and prioritize systems where untrusted users or workloads can reach kernel networking paths.

We’ve had two significant server vulnerabilities disclosed this week, and both warrant immediate attention from anyone running Linux servers or cPanel-based hosting.

What’s Been Disclosed

CVE-2026-31431 (“Copy Fail”) A flaw in the Linux kernel that could allow a local user to gain unauthorized root access. While it requires local access to exploit, on shared hosting environments or any server with multiple user accounts, this is a serious privilege escalation risk.

CVE-2026-41940 – A critical authentication bypass vulnerability in WHM/cPanel that could allow remote attackers to gain administrative access. This one is particularly nasty because it’s remotely exploitable, no prior access required.

Why This Matters

Most hosting environments in Ireland (and globally) run some flavour of Linux, and a huge portion of shared and reseller hosting sits on top of cPanel/WHM. That means these two CVEs together cover a substantial slice of the web hosting world.

If you manage your own server, VPS, or dedicated box, these are on you to patch. If you’re on managed hosting with us at WebWorld, we’ve already taken care of it across our infrastructure.

Are You Vulnerable to Copy Fail?

To make life easier, we’ve put together a free tool that lets you check whether your domain is running on a server that’s still exposed to the Copy Fail bug:

? https://www.checkdomain.ie/copyfail/

Just enter your domain and we’ll do the rest. No login, no signup just a quick check.

How to Fix Them

For Copy Fail (CVE-2026-31431):
Update your Linux kernel to the latest patched version. On most distributions, that’s:Copy

# Debian/Ubuntu
sudo apt update && sudo apt upgrade -y
sudo reboot

# RHEL/CentOS/AlmaLinux/Rocky
sudo dnf update -y
sudo reboot

A reboot is required for the new kernel to take effect.

For the cPanel/WHM bug (CVE-2026-41940):
Simply update cPanel to the latest version. If you’ve got automatic updates enabled, you may already be patched, but it’s worth logging in and double-checking. You can run:Copy

/scripts/upcp --force

…from the command line as root to force an update immediately.

Need a Hand?

If you’re not sure whether you’re vulnerable, or you’d rather someone else handle the patching, get in touch. We can audit your server, apply the fixes, and verify everything’s locked down properly.

We’ve received numerous reports from clients about fraudulent domain renewal emails and invoices that appear to come from a company calling itself IDS Ireland. These messages try to look like legitimate renewal notices and urge immediate payment for a “domain renewal notification service.” They are not from us and are fraud.

How this scam works

• Scammers send an email that looks like an invoice or renewal notice from IDS Ireland (info@idsireland.com or similar).
• The message claims to be an official renewal for your domain and asks you to click a link or press a “View Invoice / Pay now” button.
• The price quoted is often much higher than a normal renewal (we’ve seen amounts around €72–€92), and the goal is to get payment details or trick you into paying a fraudulent invoice.

How to spot a fake renewal email

• Sender should be accounts@webworld.ie. If the message comes from any other address (for example info@idsireland.com), treat it as suspicious.
• Unexpected invoice or unfamiliar company name. If you didn’t request a service, be suspicious.
• High price compared with normal renewal costs. Scammers often charge multiple times the usual fee.
• Urgency to pay now. Pressure to act quickly is a red flag.
• Links that don’t match our website. Hover over links (without clicking) to check destinations.
• Generic greetings or incorrect account details. Legitimate notices usually reference your account and control panel.

What to do if you receive one of these emails

1. Do not click any links or buttons.

2. Do not reply to the message. Replies can confirm your address is active.

3. Check your domain status directly by logging into your registrar account (do not use links in the email).

4. Forward the suspicious email to our support at support@webworld.ie and include the original message as an attachment or forwarded email.

5. Mark the email as spam or phishing in your email client.

6. If you already clicked a link but did not enter payment details, change any passwords you may have used and monitor accounts for suspicious activity.

7. If you entered payment details or paid, contact your bank or card issuer immediately to report potential fraud and request a charge dispute.

Who are IDS Ireland?

This is a fake company, it is not registered with the CRO in Ireland.

The domain idsireland.com was registered on the 1st of September 2024. However they have been opperatig for at least 7 years under diffent names including:

idseu.org
idsireland.org
idsmail.org
idsus.org
drnsbulgaria.org
drnsdenmark.org
drnsfinland.org
drnssk.org
drnssweden.org
drnsuk.org

The address on their website is 31-36 Ormond Quay Upper, Dublin, D07 EE37, which is a virtual office and essentially a mail forwarding service. They are using this virtual address in an attempt to look local.

Final Thoughts

Domain renewal scams like this are becoming more common and increasingly convincing. Scammers often use real WHOIS data (domain names and contact details from public sources) to make their messages look truthful and relevant, but that doesn’t mean they actually manage or control your domain.

If you receive a notice about your domain:

• Always check directly with your actual registrar, log into your account instead of clicking links in the email.
• Never pay an invoice from a company you don’t recognise. Your domain can only be renewed through the registrar you originally used.
• Scammers rely on urgency and fear to get you to act without verifying the details, take a moment to double‑check first.

In short: stop, verify, and don’t pay until you are absolutely sure the request is genuine. If in doubt, contact your registrar or web support team before taking any action. If you have any questions please contact: support@webworld.ie

Warning About Fake Domain Renewal Emails From IDS Ireland 22/02/2026

We’ve received numerous reports from clients about fraudulent domain renewal emails and invoices that appear to come from a company calling itself IDS Ireland. These messages try to look like legitimate renewal notices and urge immediate payment for a “domain renewal notification service.” They are not from your us and are attempts at fraud.

How this scam works

• Scammers send an email that looks like an invoice or renewal notice from IDS Ireland (info@idsireland.com or similar).

• The message claims to be an official renewal for your domain and asks you to click a link or press a “View Invoice / Pay now” button.

• The price quoted is often much higher than a normal renewal (we’ve seen amounts around €72–€92), and the goal is to get payment details or trick you into paying a fraudulent invoice.

How to spot a fake renewal email

• Sender should be accounts@webworld.ie. If the message comes from any other address (for example info@idsireland.com), treat it as suspicious.

• Unexpected invoice or unfamiliar company name. If you didn’t request a service, be suspicious.

• High price compared with normal renewal costs. Scammers often charge multiple times the usual fee.

• Urgency to pay now. Pressure to act quickly is a red flag.

• Links that don’t match our website. Hover over links (without clicking) to check destinations.

• Generic greetings or incorrect account details. Legitimate notices usually reference your account and control panel.

What to do if you receive one of these emails

1. Do not click any links or buttons.

2. Do not reply to the message. Replies can confirm your address is active.

3. Check your domain status directly by logging into your registrar account (do not use links in the email).

4. Forward the suspicious email to our support at support@webworld.ie and include the original message as an attachment or forwarded email.

5. Mark the email as spam or phishing in your email client.

6. If you already clicked a link but did not enter payment details, change any passwords you may have used and monitor accounts for suspicious activity.

7. If you entered payment details or paid, contact your bank or card issuer immediately to report potential fraud and request a charge dispute.

Sample message from IDS Ireland

Who are IDS Ireland?

• This is a fake company, it is not registered with the CRO in Ireland.

• The domain idsireland.com was registered on the 1st of September 2024. However they have been opperatig for at least 7 years under diffent names including:

idseu.org
idsireland.org
idsmail.org
idsus.org
drnsbulgaria.org
drnsdenmark.org
drnsfinland.org
drnssk.org
drnssweden.org
drnsuk.org

• The address on their website is 31-36 Ormond Quay Upper, Dublin, D07 EE37, which is a virtual office and essentially a mail forwarding service. They are using this virtual address in an attempt to look local.

Final Thoughts

Domain renewal scams like this are becoming more common and increasingly convincing. Scammers often use real WHOIS data (domain names and contact details from public sources) to make their messages look truthful and relevant, but that doesn’t mean they actually manage or control your domain.

If you receive a notice about your domain:

• Always check directly with your actual registrar, log into your account instead of clicking links in the email.
• Never pay an invoice from a company you don’t recognise. Your domain can only be renewed through the registrar you originally used.
• Scammers rely on urgency and fear to get you to act without verifying the details, take a moment to double‑check first.

In short: stop, verify, and don’t pay until you are absolutely sure the request is genuine. If in doubt, contact your registrar or web support team before taking any action. If you have any questions please contact: support@webworld.ie