Acronis Backup Plugins for cPanel, WHM and Plesk Hit by Privilege Escalation Flaw

·1 views

A high-severity vulnerability, CVE-2026-87886, has been identified in Acronis Backup plugins for cPanel & WHM and Plesk on Linux systems, caused by insecure file permissions. India's CERT-In published the advisory as CIVN-2026-0466 on 18 September 2026, warning that a remote attacker could exploit the flaw to escalate privileges, execute arbitrary code, or perform unauthorized actions. The affected versions are Acronis Backup plugin for cPanel & WHM before build 1.9.3.1021 and Acronis Backup extension for Plesk before build 1.8.11.638. Because backup plugins handle credentials and data across multiple hosted accounts, a successful attack on a shared hosting node could potentially compromise other tenants on the same machine. Acronis has released fixed builds and advises administrators to upgrade immediately and verify file permissions on plugin directories as per advisory SEC-10986.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Silent CI tool flaw: empty file sets falsely reported as passing checks

A software team discovered that one of their pre-commit checking tools was returning a PASS verdict even when it had scanned zero files, making a genuinely clean tree indistinguishable from one the tool had never actually read. The root cause was that running git ls-files inside a git archive export — which lacks a .git directory — caused the command to silently walk up to a parent repository, finding nothing and exiting without error. To fix the ambiguity, the team introduced a third verdict state, NOT RUN, which is triggered when the scanned file set is empty and includes the working directory and command used so reviewers can understand why no files were read. The team also uncovered a related issue where piping tool output through tail -6 silently dropped a key data line, causing recorded metrics in commit messages to reflect stale figures rather than the actual state of the codebase. Both fixes were verified to leave existing valid outputs byte-identical, and each tool's self-test suite was expanded to explicitly cover the empty-set scenario.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Deploy to a Private AWS EC2 Instance Using GitHub Actions, SSM, and OIDC

A software developer has documented building a fully automated CI/CD pipeline using GitHub Actions to deploy a multi-container Docker Compose application hosted on a private AWS EC2 instance with no public IP address. Because the server sits behind an Application Load Balancer in a private subnet, traditional SSH-based deployment methods were not viable, ruling out stored SSH keys or a bastion host. The solution combined AWS IAM OIDC for keyless, short-lived authentication with GitHub Actions, and AWS Systems Manager (SSM) to remotely execute commands on the unreachable server. The pipeline automatically builds, tests, and containerizes code on every push to the main branch, then orchestrates the full four-service Docker Compose stack — including PostgreSQL, a backend, a frontend, and Nginx — respecting health-check dependencies to prevent startup failures. Infrastructure was provisioned and managed using Terraform, which had already partially configured the required IAM and SSM resources.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How 216 passing tests missed four critical bugs in an encrypted messenger app

A developer building an end-to-end encrypted messenger discovered four serious bugs only after testing against a live deployment, despite having 216 passing unit, integration, and end-to-end tests. The first bug caused offline-held messages to be dropped because the server delivered them before the client had finished loading its decryption keys from asynchronous browser storage. A second flaw meant the server deleted held messages upon socket arrival rather than after successful decryption and display, permanently destroying data on both sides. A third issue caused all messages — even those delivered to online users — to be stored server-side indefinitely, since the deletion logic only triggered for messages confirmed out of offline storage. The bugs collectively highlight that test environments completing I/O instantly, and imprecise definitions of 'received' versus 'handled', can mask critical race conditions and data-loss scenarios invisible until production.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer fixes false duplicate flags in WordPress plugin caused by WPML language copies

A WordPress developer discovered a critical flaw while testing duplicate image detection in Filikod, a free alt text audit plugin, on a client site with 3,099 images across three languages. The tool incorrectly flagged translation copies created by multilingual plugins like WPML, Polylang, and Bogo as duplicate images, since each creates a separate attachment per language pointing to the same file. Deleting such flagged attachments risked breaking translated pages by removing their associated images. The fix involved mapping all language-linked attachments into translation sets so the tool treats each set as a single image rather than multiple duplicates. The same logic was applied to the alt text audit, which had been incorrectly penalising sites for identical alt text across language variants of the same image.

0 comments Read more at DEV Community