WordPress 7.0.4 patches 10-year-old PNG flaw; OVHcloud warns of 87% price hikes due to memory shortage
My Take
What happened WordPress 7.0.4 closed CVE-2026-65640, a flaw that allowed logged-in authors to execute code via image files, on August 12.
Why it matters to hosts This is a core WordPress vulnerability affecting every host running WordPress sites; even though it requires author-level access, it's in the wild now and your customer sites need the patch immediately or they're exposed.
What to do Audit your WordPress installations to confirm they're running 7.0.4 or later, and contact any customers who haven't auto-updated to push the upgrade.
My view What strikes me is that this flaw sat dormant for nearly a decade—it's a good reminder that old code paths can hide serious problems. The WordPress team acted quickly with a same-day release, which is the right call, but this underscores why we can't assume that "tested" code from years ago is actually safe.
How many of your hosted WordPress sites do you think are still running pre-7.0.4, and what's your current process for forcing critical updates on customer installations?
Key Themes
Notable Players
Released security patch 7.0.4 closing CVE-2026-65640, a code-execution flaw in PNG handling that had existed for nearly 10 years.
Announced price hikes of up to 87% on select services due to critical memory shortages in the supply chain.
Committed to increasing data center capacity 7x by late 2027, targeting 10 GW of compute power and up to $500 billion in revenue.
Published 2025 survey results from 401 hosting customers on feature priorities and product roadmap feedback.
Launched Expiry APIs for GoDaddy Auctions to enable automated domain acquisition workflows.
Top Stories
WordPress patched CVE-2026-65640 on August 12, allowing logged-in authors to execute code via crafted PNG images. Every host running WordPress needs to upgrade immediately—this is live in the wild.
Memory component scarcity is forcing OVHcloud to raise prices significantly, signaling broader supply-chain strain across the hosting industry. Expect similar pressure on other major providers.
Nvidia's massive financing push for AI infrastructure underscores that power and interconnection constraints—not hardware cost—are now the limiting factors. Plan accordingly if you're competing for grid capacity.
xAI plans to reach 10 GW of nameplate power by late 2027, demonstrating the scale of capital being committed to AI compute. This will compete heavily for fiber, power, and real estate in key regions.
Phoenixnap's Radius facility experienced downtime due to cooling system failure, a reminder that infrastructure resilience depends on more than just redundant network paths. Monitor your provider's real-time status.
Security & Compliance
Cloudflare's Certificate Transparency Monitoring tool is now GA, reducing noise by eliminating alerts for certificates Cloudflare itself issued on your behalf. Helps you focus on actual rogue cert threats.
Nightmare Eclipse released ShieldBreak, a Windows privilege-escalation zero-day; Microsoft has reportedly already rolled out Defender protections. Monitor Windows Update deployments on your infrastructure.
A hardcoded AWS credential in client-side JavaScript enabled unauthorized access to a CRM customer database. Audit your customer applications for exposed credentials in front-end code.
A zero-day in Zoom allows any participant to seize control of another user's device; researchers used AI to find the exploit. Update Zoom clients immediately across your organization.
Pricing & Business
ChangXin Memory Technologies (CXMT) surpassed Tencent in market cap shortly after IPO, reflecting investor confidence in semiconductor memory supply. Watch for CXMT to become a key memory vendor for data center buildout.
Intel CEO's $12M personal stock purchase signals internal confidence in the foundry business, with analysts citing progress on external customer wins. Relevant for operators evaluating long-term processor sourcing strategy.
Cerebras missed earnings despite 281% AI cloud revenue growth, as hardware sales declined. Signals a shift in customer preference toward renting versus owning specialized AI accelerators.
Storage provider offering 40TB capacity at $80/month provides a reference point for competitive bulk storage pricing. Compare against your own cost basis to stay competitive in the commodity storage market.
Tencent is betting $53B on AI hardware with plans to monetize it immediately through rental rather than building proprietary models. Shows how major players are treating infrastructure as a profitable service business.
Control Panels
Plesk surveyed 401 hosting customers on 2025 feature adoption and priorities for future development. Key insights on what independent hosts value in control panel tooling and roadmap direction.
Data Centers & Infrastructure
Copper, lithium, and rare earth supply constraints are testing whether infrastructure producers can keep pace with AI data center demand. Expect further delays and cost pressures if supply remains tight.
AI data center buildout is driving new demand for dedicated dark fiber, while optical equipment constraints threaten to limit expansion on existing routes. Plan interconnection strategy early.
Ofgem is introducing substantial refundable fees for data center power connections to curb speculative bidding and stabilize the grid. UK hosts should expect slower queue times and higher connection costs.
A 50 MW Bitcoin mining facility sidestepped local moratoriums by exploiting state zoning gaps, highlighting power competition risks in unregulated markets. Regional policy variation can reshape facility economics.
Nine PBS lost access to 50TB of archival data when its cloud storage intermediary failed, then couldn't recover it from the underlying data center. Make clear to customers what happens if your business fails.
Cisco CEO says enterprises are rapidly replacing older networking equipment, accelerating capital cycles. Budget for network refresh cycles if you're operating or planning data center upgrades.
Technology & Tools
WordPress released an official open-source browser extension for Chrome/Chromium and Safari macOS, available in the Chrome Web Store and Mac App Store. Useful for site admins managing multiple WordPress installations.
Sites can pass all uptime checks but still block AI crawlers (ChatGPT, Perplexity); HostAdvice shows you how to diagnose and fix 403 responses to bots. Your customers' SEO and AI discoverability depends on crawler access.
Near-packaged optics (NPO) is emerging as a safer alternative to co-packaged optics (CPO) amid manufacturing and integration challenges. Relevant for operators building new high-capacity interconnection.
A WAL-Reset bug in SQLite dormant for 16 years caused Tailscale downtime; it took six months and new logging tools to identify. Underscores the risk of legacy code running in critical infrastructure.
PCIe 6.0 SSDs are arriving with controllers from Marvell, Phison, and SMI, promising up to 28 TB/s performance. Watch for availability; these will be attractive for high-IOPS workloads.
Domains & DNS
GoDaddy Auctions now offers APIs to automate expired domain tracking and bidding, narrowing the window for manual intervention. Developers can build custom workflows to monitor and acquire domains programmatically.
ICANN is evaluating blockchain naming systems' applications for the DNS root, pricing the opportunity and weighing technical compatibility. Outcome will determine whether Web3 naming integrates with the traditional DNS.
Community & Events
Domain Summit Europe 2026 kicks off August 16 in Kempten, Germany, with pre-event networking at Neuschwanstein Castle. Two days of executive-level discussions on domain and DNS policy for European operators.