Rising attacks: how to protect your website in a more vulnerable world

This week, more attacks, more alerts

In the world of digital security, every week can bring changes. This week, we've seen a 42% increase in new or updated exploits, which means there are more ways to attack websites and servers. Also, there are over 70 vulnerabilities already being used in real attacks. This doesn't mean your website is in danger right now, but it's a good time to review what security measures you have in place.

What's happening in the world

This week, 37 new exploits have been published or updated. Of these, 36 come from automated detection templates (nuclei) and one has real attack code (exploitdb). This means there are more tools to detect and, in some cases, exploit flaws in software.

Also, the number of vulnerabilities already being used in real attacks (KEV catalog) has increased by 25%, reaching 79 new vulnerabilities. This reflects that there are more active attacks in the world, and attackers are using flaws that are already known.

The cards, CVE by CVE

CVE-2020-36847

• Affected product: Simple File List < 4.2.3
• What it is: A remote code execution flaw. If an attacker manages to exploit it, they can execute commands on the server where your website is hosted.
• How it's attacked: Through a public exploit.
• What could happen: The attacker could take control of your server, steal data, or even bring down your website.
• Severity (CVSS): 9.8 (very critical)
• Exploit probability (EPSS): 0.43519 (high)
• Already exploited: Yes

CVE-2025-11201

• Affected product: MLflow
• What it is: A flaw detected by a detection template.
• How it's attacked: Through a detection template (nuclei).
• What could happen: If the flaw is exploited, it could allow unauthorized access to data or functionalities.
• Severity (CVSS): Not available
• Exploit probability (EPSS): 0.28203 (medium)
• Already exploited: Yes

CVE-2015-5468

• Affected product: WP eCommerce Shop Styling < 2.6
• What it is: A directory traversal flaw. If exploited, it could allow the attacker to access sensitive files.
• How it's attacked: Through a detection template (nuclei).
• What could happen: The attacker could read files from the server, such as configurations or sensitive data.
• Severity (CVSS): 7.5 (critical)
• Exploit probability (EPSS): 0.24093 (medium)
• Already exploited: Yes

CVE-2026-116606

• Affected product: LatePoint Appointment Booking Plugin <= 5.7.6
• What it is: An authentication flaw. If exploited, it could allow the attacker to take control of user accounts.
• How it's attacked: Through a detection template (nuclei).
• What could happen: The attacker could access user accounts without permission, as if they were the owner.
• Severity (CVSS): 9.1 (very critical)
• Exploit probability (EPSS): 0.02255 (low)
• Already exploited: Yes

CVE-2026-118066

• Affected product: WP Data Access <= 5.5.89
• What it is: An authorization flaw. If exploited, it could allow the attacker to access restricted functionalities.
• How it's attacked: Through a detection template (nuclei).
• What could happen: The attacker could access data or functionalities they shouldn't have access to.
• Severity (CVSS): 8.1 (critical)
• Exploit probability (EPSS): 0.01620 (low)
• Already exploited: Yes

How we got here

Last week we saw a 42% increase in new or updated exploits, continuing an upward trend. In the last 6 weeks, the number of exploits has fluctuated, but the average of the previous 5 weeks was 25, and this week was 37, representing a 45.7% increase.

Regarding already exploited vulnerabilities (KEV catalog), this week was 79, representing a 25.4% increase from the previous week. The average of the previous 5 weeks was 75, so this week is slightly above average.

What's happening behind the numbers

These data reflect that attackers are using more automated tools to detect and exploit flaws. Detection templates (nuclei) allow attackers to quickly identify whether a website has a known flaw. If the flaw also has a public exploit (as in the case of CVE-2020-36847), then the attack is easier to carry out.

Also, the fact that there are more already exploited vulnerabilities (KEV) indicates that attackers are using flaws that are already known, which suggests that many systems are not updated or do not have adequate protection measures.

What we can expect

If the trend continues, it's likely that the number of new or updated exploits will continue to increase. A linear projection suggests that next week there could be between 43 and 45 new or updated exploits. This doesn't mean your website is in danger right now, but it's a good time to review what security measures you have in place.

The optimistic scenario would be that the number of new or updated exploits stabilizes or even decreases. The pessimistic scenario would be that the number continues to increase, which could mean more real attacks and more already exploited vulnerabilities.

How it can affect your website or business

Scenario 1: Unupdated plugin

Imagine you have an online store and you're using a WordPress plugin that you haven't updated. If that plugin has a flaw like CVE-2020-36847, an attacker could exploit it to execute commands on your server. This could mean your website stops working, customer data is stolen, or malware is installed.

Scenario 2: Automated attack

Imagine an automated bot is trying passwords on your website. If you have a weak or reused password, the bot could guess it and access your admin account. Once inside, the attacker could change your website's content, steal data, or even sell access to other attackers.

Scenario 3: Attack on a shared server

Imagine your website is on a shared server and another client on that server hasn't updated their software. If that client has a flaw like CVE-2020-36847, an attacker could exploit it to access other sites on the same server, including yours. This could mean your website stops working or customer data is stolen.

How to protect yourself and prevent attacks

1. Update plugins and CMS regularly. Updates usually include patches for known flaws. If you installed your website from SWPanel, you can enable automatic updates.
2. Use strong and unique passwords. A weak or reused password can be easily guessed or stolen. Use a password manager to generate and store secure passwords.
3. Enable two-factor authentication (2FA). 2FA adds an extra layer of security, as you need two things to access your account: a password and a verification code.
4. Review user permissions. Make sure only necessary users have access to sensitive functionalities. If a user no longer needs access, revoke it.
5. Use a web firewall. A web firewall filters attacks before they reach your application. If your website is on a shared server, a firewall can protect it from attacks on other sites on the same server.
6. Enable bot blocking. Automated bots can try passwords or attack your website. BotLock can help you block malicious bots.
7. Make regular backups. If your website is attacked, backups allow you to recover it quickly. If you installed your website from SWPanel, you can enable automatic backups.
8. Review Security 360 alerts. If you have a plan with Security 360, you'll receive alerts when flaws affecting your website are released. This allows you to act before someone exploits the flaw.
9. Use regular security analysis. The Security 360 security analysis detects CMS, plugins, and versions with known flaws. This allows you to identify and fix problems before someone exploits them.
10. Keep your server updated. If your website is on a shared server, make sure the provider keeps the server updated. If you're using a dedicated server, update it yourself or hire a maintenance service.

What SWPanel tools can help you

• Security 360 security analysis: Detects CMS, plugins, and versions with known flaws. If you have a plan with Security 360, your website is regularly analyzed and marked in the panel if there are issues.
• Security 360 security alerts: Alert you when flaws affecting your website are released. This allows you to act before someone exploits them.
• BotLock: Controls and blocks malicious bots and crawlers from your website. If you have a plan with BotLock, you can configure which bots to allow and which to block.
• Web firewall: Filters web attacks before they reach your application. If you have a plan with a web firewall, you can configure rules to block specific attacks.
• Automatic CMS updates: If you installed your website from SWPanel, you can enable automatic updates for WordPress, Joomla, Drupal, etc. This ensures your CMS is always up to date.
• Backups: If you installed your website from SWPanel, you can enable automatic backups. This allows you to quickly recover your website if it's attacked.
• PHP version change: If your website uses an unsupported PHP version, you can switch to a supported version from the hosting panel. This ensures your website receives security patches.
• Ticket support: If you have questions or need help, you can contact our support via ticket. We help you configure security measures or resolve issues.

Quick summary

• The number of new or updated exploits has increased by 42% this week.
• There are over 70 vulnerabilities already being used in real attacks.
• Updating plugins and CMS, using two-factor authentication, and using a web firewall are key measures to protect your website.

Sources

The data for this week comes from public sources such as the KEV catalog, Emerging Threats detection rules, and published exploit statistics.