Selected events and fix thresholds
This retrospective covers 2026-02-01 to 2026-02-28. Sources were checked on 6 November 2026. The table lists historical fix thresholds in the corresponding branches. Before deploying, choose a currently supported release or a distributor package with the relevant backport; an old fix threshold is not a recommendation to install an obsolete branch.
For the selected items, this review confirms the disclosure or security release and its stated conditions. Active exploitation and historical CISA KEV or EPSS status are not asserted here. Missing exploitation evidence remains unknown.
| Event date | Product and advisory | Fix thresholds by branch |
|---|---|---|
| 2026-02-04 | NGINX | CVE-2026-1642 | 1.29.5 / 1.28.2 |
| 2026-02-10 | WPvivid Backup | CVE-2026-1357 | 0.9.124 |
| 2026-02-25 | n8n | CVE-2026-27577 | 1.123.22 / 2.9.3 / 2.10.1 |
NGINX: responses from TLS upstreams (CVE-2026-1642)
An attacker positioned between NGINX and a TLS upstream can, with additional conditions, inject plaintext into the upstream response. This concerns reverse-proxy connections to HTTPS backends. It does not mean every public HTTPS connection to NGINX is affected in the same way.
Ask the host to map HTTPS upstreams and apply the appropriate OSS or Plus package. Verify the backend certificate policy and a real proxied application response after the change.
WPvivid: backup reception and file uploads (CVE-2026-1357)
WPvivid Backup through 0.9.123 can permit unauthenticated file upload and code execution when a generated key enables receiving backups from another site. That feature is off by default. Wordfence published its report on 10 February; the fixed plugin release had shipped on 28 January.
Check the exact plugin slug and whether a reception key was active. Update the plugin, remove unused reception access and perform a controlled backup and restore check.
n8n: workflow editors and host commands (CVE-2026-27577)
A signed-in user allowed to create or edit workflows can escape expression evaluation and execute commands on the n8n host. This matters where website forms or shop events trigger self-hosted automations with access to other systems. Fix thresholds differ across the three release lines.
Update the deployed n8n branch and review workflow-editor accounts. Test an enquiry through its full automation route and record which credentials and network destinations the workflow can access.
Breaches and cyber incidents reported this month
These cases were publicly reported during February 2026. Discovery dates are stated separately where known. The summaries retain the limits of the cited notices: an outage alone does not establish data theft, and exposed records are not automatically a count of people.
| Organization | Public notice | Incident |
|---|---|---|
| Odido | 2026-02-12 | Information exposure |
| BridgePay | 2026-02-06 | Ransomware and disruption |
Odido: customer contact data without a service outage (2026-02-12)
On 2026-02-12, Odido confirmed a cyberattack affecting personal data in a customer contact system. Its initial statement excluded passwords, call records and invoice data, and said calling, internet and television services remained available.
A working service does not establish that customer records are protected. Review CRM export rights and unusual support-account access, and prepare customer communications that name the affected data categories precisely.
BridgePay: ransomware interrupted payment processing (2026-02-06)
BridgePay's 2026-02-06 status updates linked its system-wide outage to ransomware. Initial forensic findings did not indicate compromise of payment-card data. The confirmed operational disruption and the assessment of data exposure were separate findings.
Test how checkout and order handling behave when the payment gateway is unavailable. Document an alternative payment process, reconcile uncertain transaction states and verify successful processing before returning to normal operation.
Coverage and editorial record
This is a selected review for business websites and hosting, not a complete monthly vulnerability inventory. Each section links to its evidence. Public disclosure or a security release determines the coverage month; a private report date, CVE reservation year or later record edit does not determine that month.
The first edition was prepared on 6 November 2026. Current advisories may contain later corrections, so this article does not claim to reproduce their exact month-end state. No corrections are recorded for this edition. A substantive change will receive a dated note and updated article metadata.
