BigWetFish Web Hosting

20/08/2026

🚨 Critical Elementor Pro security vulnerability — CVSS 9.0

A critical unauthenticated remote code ex*****on vulnerability has been discovered in Elementor Pro (CVE-2026-32475).

The flaw affects the Forms module's file upload functionality and could allow an attacker with no login required to upload a malicious PHP file and gain remote code ex*****on.

This is one you really shouldn't ignore.

Why it matters:

→ No authentication is required, meaning attacks can be automated and widespread.
→ Premium plugins aren't always automatically updated, so sites can remain vulnerable for some time.
→ The vulnerability affects Elementor Pro 4.2.1 and below.

If you're running Elementor Pro, update to 4.2.2 as soon as possible. Don't wait for your normal maintenance window.

Already protected?

If your website is covered by BWF's WordPress Maintenance Service with Patchstack, you're already protected. Patchstack provides virtual patching while the update is being rolled out, so there is no need to panic.

But please don't use that as a reason to ignore the update. Virtual patching is an important layer of protection, but keeping Elementor Pro fully up to date is still the right thing to do.

If you're using WP Umbrella as part of your BWF WordPress Maintenance package, we have already pushed the 4.2.2 update across your sites.

Stay safe. 🔒

12/08/2026

All clients on our WordPress Maintenance Service have already been upgraded to WordPress 7.0.4 less than 1 hour after the security update was released.

As we raise the bar on security all new and existing Business Standard and Pro Plans will come with this added protection as standard (give us a few weeks to work through them).

Business Starter plans can add it for a small additional fee.

29/07/2026

A massive power outage hit Carrickfergus today, and I had to leave work to help sort out my mum’s backup oxygen tank as her oxygen concentrator machine relies on electricity.

Thankfully, we had a backup plan in place.

It got me thinking about how important preparation is not just in our personal lives, but also when it comes to our businesses.

We often don’t think about disaster recovery until something goes wrong. But when a website goes down, data is lost, or a security issue happens, having the right systems already in place can make all the difference.

For WordPress websites, a good protection strategy should include:

✅ Reliable backups that you can restore from
✅ Keeping plugins, themes and WordPress updated
✅ Regular vulnerability patching
✅ Security monitoring and protection

Backups help you recover.
Patching helps prevent problems.
Security monitoring helps detect and stop threats.

At Big Wet Fish Hosting, we take a layered approach using tools including WP Umbrella⁠ for WordPress maintenance, updates and backups, Patchstack⁠ for vulnerability patching, and Monarx⁠ for proactive malware and threat protection.

Today was a reminder that having a plan before you need it is always better than trying to react when something has already gone wrong.

Whether it’s an oxygen machine, a website, or any other important system - preparation matters.

Talk to us for any advice on this important subject.

19/07/2026

Scott L from our support team finished bottom of a local fantasy football league last season, which means he’s now got 12 forfeits to complete throughout the year!

This is July’s challenge… and the Ronaldo-inspired shave took place today during his lunch break. ⚽✂️

We’re letting Scott finish a little earlier than usual tonight so he can watch the Cup Final. Our remote team will take over just before kick-off, and management will be on hand for any escalations to ensure everything continues running smoothly.

Good luck Scott… and we’ll see what next month’s forfeit brings! 😄

18/07/2026

If your website is WordPress you should update your core today to 7.2. Versions earlier than 6.8 are unaffected and there are also backports to affected earlier branches namely 6.9.5 and 6.8.6 so update to these if your site is not able to go to 7.x

This is a serious vulnerability one rated as critical. All managed WordPress BWF clients have already been patched against this - talk to our team to add this valuable protection today.

—————————————————————————
What you need to know

CVE-2026-60137: SQL injection. A vulnerability in WordPress version 6.8 and later allows crafted input to alter a database query.

Rating High.

CVE-2026-63030: Unauthenticated remote code ex*****on. A vulnerability in WordPress version 6.9 and later allows an unauthenticated attacker to execute code through the batch endpoint of the REST API when a persistent object cache is not in use. This vulnerability is related to the SQL injection described above. No login or user interaction is required to exploit this vulnerability.

Rating Critical.

23/06/2026

Hourly backups for your WordPress website?

We've got you covered through our partnership with WP Umbrella.

Protect your website with automated hourly backups and enjoy the peace of mind that comes from knowing your data is always secure and recoverable.

Get in touch today for pricing and to activate this powerful service.

19/06/2026

Happy to have made a contribution to sponsor this recent event at Carrickfergus Grammar School.

14/06/2026

When a new WordPress exploit is disclosed, attackers 🤖 move immediately. Scanning and exploitation are automated.

That's why we now include Patchstack with every WordPress Hosting Package. For clients on another hosting package & Resellers you can add Patshctack today for a small additional fee. Reach out to our team today with any questions by emailing [email protected]

https://patchstack.com/security-operational-drag

20/05/2026

https://tuxcare.com/blog/cve-pintheft/

Fifth vulnerability this month. This is why we now require server clients to OPT OUT of Kernel Care Protection rather than opt in. It's been added to all servers for protection and clients who prefer not to pay the small charge are free to opt out by contacting us.

As Tuxcare say - "Don’t want a fifth emergency reboot window this month? KernelCare applies rebootless Linux kernel patches without downtime or disruptions."

PinTheft chains RDS and io_uring to give local users root access on exposed Linux hosts. Learn who’s affected, how to check exposure, and how to mitigate it.

06/05/2026

Saying Goodbye to Levi 💔

We were heartbroken today in the office to hear the news about Levi.

As many of you know, we partner with Husky Networks for our East Antrim Data Centre, and over the years we’ve worked closely with Alan and, of course, Levi. Whether he was sitting proudly in the NOC office or keeping watch in the Systems Admin office, Levi was always part of the team.

I wanted to write a tribute myself, but Alan’s words from the Husky Networks page say it better than I ever could:

“It’s with a very heavy heart that I’m sharing some sad news today. This morning, I had to say goodbye to my best friend and the heartbeat of this company, Levi.

As many of you know, Husky Networks wasn’t just named after the breed, it was named after him. For 16 years, Levi was my constant shadow. If you’ve seen the Husky Networks van on a job site, you’ve seen Levi. He claimed the passenger seat as his own from day one, and he was the best co-pilot I could have ever asked for.

To the customers who brought him treats, the site managers who gave him a pat, and everyone who welcomed him alongside me: thank you. You made his workdays just as bright as he made mine.

The van feels incredibly empty today, and the passenger seat will be hard to look at for a while. But Levi lived a long, full life on the road, and I’m proud that his legacy will live on every time I pull up to a job.

Thanks to all of you for being part of his journey over the last 16 years. It meant a lot to both of us.”

Thinking of Alan and everyone at Husky Networks today. Rest easy, Levi. 🐾