Canadian Web Hosting incident

Critical WordPress Core Vulnerability - "WP2Shell" (CVE-2026-60137 / CVE-2026-63030)

Minor Ongoing View vendor source →

Canadian Web Hosting is currently experiencing a minor incident, which began 84d ago. The vendor's full update timeline is below.

Started
Jul 29, 2026, 03:32 AM UTC
Resolved
Ongoing
Duration
● 84d 10h
Detected by Pingoru
Jul 29, 2026, 03:32 AM UTC

Update timeline

  1. identified Jul 29, 2026, 03:32 AM UTC

    A critical vulnerability chain in WordPress core, dubbed "WP2Shell" (CVE-2026-60137 / CVE-2026-63030), is being actively exploited worldwide. It allows complete site takeover with no login required. This is a vulnerability in the WordPress application itself (not an issue with our hosting platform or servers). Our infrastructure is operating normally. Affected versions: WordPress 7.0.0–7.0.1, 6.9.0–6.9.4, and 6.8.0–6.8.5 (SQL injection component only). Action required: Update your WordPress site immediately to 7.0.2, 6.9.5, or 6.8.6 (or newer) via Dashboard → Updates. Do not rely on auto-updates (verify your version manually). After updating, change your WordPress admin passwords as a precaution. Need help? Open a support ticket and our team will verify your version, apply the update, and review your site for any signs of compromise.