VMware 迎来虚拟机逃逸漏洞：CVE-2026-47876 或允许 Guest VM 在 ESX 宿主机上执行代码
VMware ESXi 曝出 CVE-2026-47876 高危漏洞，VMXNET3 虚拟网卡存在越界写入，攻击者在 guest VM 内获得管理员权限后可能逃逸到宿主机执行代码。今年 KVM 侧已出现 ITScape、Januscape、Zapscape 三次同类逃逸，VMware 首次中招。
评论
点赞
收藏cPanel替代品市场持续扩大，新面板来自cPanel生态内部
Pyxsoft推出新控制面板CorePanel，7月14日发布免费版，按服务器定价。该公司长期为cPanel服务器提供反恶意软件和防火墙工具，CorePanel基于自有Web服务器构建，面向RHEL系列服务器。
Web3 命名竞逐 DNS 根目录，ICANN 开出条件
ICANN 发布草案报告，首次回应区块链命名系统能否与现有 DNS 共享名称的问题，公开征求意见窗口已于 8 月 12 日关闭。
WordPress 7.0.4 修复了一个伪装成 PNG 的恶意代码执行漏洞，漏洞机制已存在近十年
WordPress 7.0.4 修复了 CVE-2026-65640，允许已登录作者通过上传伪装成 PNG 的恶意文件在服务器上执行代码。该漏洞机制已有近十年历史，本质是文件类型欺骗。
Webhosting Today Experts Join Exclusive Delegate Roster at Domain Summit Europe 2026
KEMPTEN, Germany: Domain Summit Europe 2026 officially kicks off this Sunday, August 16, with an exclusive pre-event networking tour to Neuschwanstein Castle before moving into two days of executive s...
Google 现场数据：在线网站速度差距超过两倍
Google Chrome 浏览器收集的现场数据揭示了不同网站托管平台之间页面加载速度的巨大差距，超过两倍。这项数据来自真实用户访问，任何供应商都无法粉饰。
Metabase Cloud 在用户不知情的情况下被修复漏洞，自托管用户只能自己处理
Metabase Cloud 曝 CVSS 10 漏洞，无账户可注入 SQL。攻击者通过公开密码重置接口注入 SQL 即可获取实例管理员权限。Metabase 在用户知情前已为云用户完成修复，自托管用户需自行处理。
GoDaddy 每品牌平均 2400 万域名，team.blue 仅 16.3 万
Web hosting consolidation isn't a single trend — two opposite strategies are running at once. GoDaddy averages 24 million domains per brand, while averages just 163,000. The gap in domains-per-brand is the key differentiator between the two consolidation models.
Cloudflare 未建独立政府云，即获 FedRAMP High 认证
Cloudflare 宣布其政府云服务获得 FedRAMP High（Class D）认证，可承载美国联邦政府最高密级未分类数据。与多数云厂商不同，Cloudflare 未搭建独立政府云基础设施，而是复用现有架构通过认证。 sponsoring agency 为 NIST，独立评估方为 Schellman Compliance。
Zapscape 突破 Linux KVM 边界：没有 VM 的服务器同样危险
Linux KVM 虚拟机监控程序存在一个 use-after-free 漏洞（CVE-2026-64561），已在 2026 年 8 月 6 日披露。攻击者只要在内某台 VM 中拿到 root 权限，就可能突破隔离逃逸到宿主机，直接威胁共享同一物理机的其他客户。VPS 和云托管的经济模型建立在"每个用户被 hypervisor 密封在独立 VM 内"这一承诺之上，Zapscape 打破了这个前提。
Roundcube 发布安全更新，11 个修复无一标注 CVE
Roundcube 8月9日发布1.7.3和1.6.18两个版本，共11项安全修复，但全部没有分配CVE编号。cPanel将Roundcube作为打包组件提供给托管服务商，这类部署场景需要关注更新。
Porkbun Passed 4 Million Domains. The More Interesting Number Is 750,000.
Porkbun announced this week that it has crossed 4 million domains under management. Milestone posts from registrars are usually a formality, and this one comes with the pig puns the company is known f...
AI模型10小时25美元挖出WordPress漏洞，补丁发布90分钟后遭攻击
Searchlight Cyber用GPT-5.6 Sol Ultra在10小时内、花费约25美元找到WordPress核心漏洞并实现远程代码执行。7.0.2补丁发布后90分钟即出现攻击尝试，WAF规则因只匹配URL而普遍被绕过。 WordPress安全报告量从每月数十起增至7月450起，AI辅助研究正在压缩漏洞生命周期。
10,000 Sites Flagged in Weeks: Patchstack and Hostinger on npm Scanning by Default
On July 7, Hostinger switched on Patchstack’s vulnerability intelligence for Node.js applications hosted on its Business and Cloud plans, scanning npm package dependencies for known flaws by default. ...
Running a Domain Costs About a Dollar a Year. Here Is What Eight Registries Charge for It.
Montenegro’s case for taking.me back under state control leaned on an argument about money: the domain earned €114 million between 2008 and 2025, the state kept about a third, and it now wants at leas...
Hosting’s Next Six Months Are Already Scheduled: Five Dates to Prepare For
Most of what will move hosting P&Ls between now and January is not a surprise waiting to happen: the deadlines, effective dates and sale windows are published, dated and attached to countdowns. That m...
Blesta 6.0: A Rebuilt Admin, an AI Ticket Autopilot and Native MRR Analytics
Blesta, the self-hosted billing and automation platform used by hosting providers, shipped version 6.0 on August 4, and the company calls it the biggest release in its history: an admin interface rebu...
Montenegro Is Taking .me Back: A State Company Will Run the Million-Domain ccTLD
The government of Montenegro has formally started creating a state-owned company to manage.me, the country’s ccTLD and one of the few country codes that built a global business, with more than a milli...
When 64GB of RAM Costs €3,000: The Shortage Behind Hostinger’s Biggest Server Order
Hostinger has placed the largest server order in its history: more than 3,000 machines, enough to cover its infrastructure needs for the full year. The company announced the purchase on July 28, along...
Estonia’s Zone Joins Your.Online, a Roll-Up Now More Than 60 Deals Deep
Zone, the Estonian host and registrar that has been selling domains and hosting since 1999, is joining, the Dutch-backed group that has bought more than 60 companies since 2017, most of them European ...
DNS新增"待售"标记记录，推广取决于注册商
IETF发布RFC 10023，在DNS中新增_for-sale TXT记录，域名持有者可直接标记域名待售并附上联系方式和价格，无需经过中介或交易平台。荷兰.nl注册局SIDN已联合多家注册商开展试点，用户在控制面板点击"出售"按钮即可自动写入记录。该RFC为Informational级别，非强制标准，且注册商因二手市场利益可能存在推广动力不足的问题。
$227,000 to Apply for a New Domain Ending: The First ICANN Round Since 2012 Closes August 12
For the first time in fourteen years, anyone with a name, a plan and a serious budget can ask ICANN for their own ending to the internet. The application window for the 2026 New gTLD Program round ope...