Menu
Secure small-business workstation with network equipment, padlocks, and red accent lighting.

GiveWP Needs an Urgent Update, Plus 4 Tech Stories

, , , , , , ,

A WordPress donation plugin used on more than 100,000 sites has a CVSS 10.0 vulnerability that can end in remote code execution, and the patch has already produced a wonderfully awkward second problem: an official support reply is telling some users to roll back because of a display bug. Please don’t do that. Today’s lead is less about the number 10.0 than about what version you should actually be running.

GiveWP 4.16.7.2 fixes a critical takeover chain — and you should stay on it

Patchstack disclosed CVE-2026-82222 on Friday, a critical vulnerability in the GiveWP donation plugin for WordPress. On the versions where the full chain is reachable, an attacker does not need an account. A published donation form and an active payment gateway can be enough to get attacker-controlled data into the donation flow, abuse unsafe PHP object deserialization, and eventually execute code on the web server.

That last phrase is the important one. Remote code execution means this can move beyond “the donation form acts weird” into somebody running commands in the context of the website. Patchstack says GiveWP 4.16.7.2, released August 27, breaks the exploit chain at several layers. If you run GiveWP, update to 4.16.7.2 now, take a current backup first, and then verify donations, receipts, recurring gifts, and any custom integrations afterward.

There is a wrinkle. A GiveWP support reply on WordPress.org says 4.16.7.2 introduced a bug that can hide donor names in the Donor Wall and recommends rolling back to 4.16.7.1 until that display problem is fixed.

I would not follow that recommendation on an internet-facing production site. Version 4.16.7.1 is specifically inside the vulnerable range Patchstack just told the world about. A broken donor-name display is annoying. Deliberately reinstalling a version with a public unauthenticated RCE chain is a different class of problem entirely. Keep the security update, accept the display bug if you hit it, and watch for the next maintenance release.

This is also a good reminder that “latest version” is not the same thing as “everything is perfect.” Sometimes the safest version has a regression. That’s why backups, staging, monitoring, and post-update testing all exist. The goal is not zero bugs. The goal is to avoid solving the smaller bug by reopening the much larger hole.

WordPress security & maintenance

Keeping WordPress current is only part of keeping it healthy. Raymond Tec handles updates, backups, security monitoring, compatibility problems, access cleanup, and maintenance — plus the assorted weirdness that accumulates on a site over time.

The U.S. government corrected a much scarier hacking claim

The Justice Department has corrected its description of a Chinese state-sponsored hacking campaign after its original August 26 announcement made it sound as though every named federal agency had been breached. They hadn’t.

DOJ’s updated release now says NASA, the Federal Reserve, the Senate, the Departments of Energy, Justice, and Health and Human Services, and the National Institutes of Health were among the group’s targets. Reuters, after comparing the corrected release with the FBI affidavit, reports that confirmed intrusions included three Energy Department national laboratories, NIH, an HHS agency, and a U.S. security-device manufacturer in September 2024. An attempted NASA intrusion failed.

Why did NASA’s attempt fail? According to the affidavit, NASA had patched the software the attackers were trying to exploit.

That is almost comically boring cybersecurity advice, which is why it’s useful. The difference between “NASA was targeted” and “NASA was hacked” is not semantic hair-splitting; one describes an attacker trying the door, the other says the attacker got inside. And in this case, basic patching appears to have helped keep that door shut. DOJ added a note on August 28 saying it edited the release so it accurately reflects the allegations in the affidavit.

Technical discovery & auditing

The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.

Google Drive can now use Gemini to classify sensitive files

Google has opened a beta for Gemini-based data classification in Google Drive. An administrator can describe the kinds of information that belong under a classification label, and Gemini can apply those labels across Drive instead of requiring somebody to manually build a training set first.

The labels can then feed data-loss-prevention rules, retention policies, and audit investigations. Google is also explicitly pitching this as an agent-security control: if a company knows which files contain sensitive information, it can make better decisions about what an automated agent is allowed to read or act on.

This is an open beta, not a magic compliance button. Somebody still has to define sensible labels, test the results, and decide what those labels actually restrict. It’s also limited to Enterprise Plus, Google AI Pro for Education, and Frontline Plus. But the direction is right. “The AI should know not to touch confidential stuff” is not an access-control policy. Classification gives you something concrete to attach the policy to.

OpenAI plans to remove its models from Cursor in November

Yes, Cursor is back in the brief one day after yesterday’s ransomware story, but for a completely different reason. OpenAI says it intends to end its model-supply agreement with Cursor after SpaceX acquired the coding-tool company. The proposed shutoff date is November 12.

OpenAI says it no longer trusts SpaceX to comply with its contractual terms, citing previous disputes with Elon Musk’s companies. Cursor says it is talking with OpenAI, so the date is not yet necessarily final. For developers who specifically depend on OpenAI models inside Cursor, there is at least a migration path: OpenAI says users can bring their own API key, use the Codex IDE extension inside Cursor, or connect through a compatible gateway such as Azure or Amazon Bedrock.

That makes this less of a “your editor stops working in November” story and more of a reminder about platform dependencies. If one model is important to your workflow, know whether you’re buying access from the model provider or borrowing it through somebody else’s contract. Those are not the same dependency.

Business IT goes well beyond the website

Your business also depends on workstations, cloud accounts, browsers, Wi-Fi, remote access, collaboration tools, and all the other technology that quietly becomes infrastructure. Raymond Tec works across that whole stack, whether the problem lives on a server, on a desk, or somewhere in between.

The 2026–27 COVID vaccines are cleared for the fall season

The FDA approved updated 2026–27 formulas from Moderna, Pfizer-BioNTech, and Novavax-Sanofi on August 27. The shots target the XFG variant, following the recommendation of the FDA’s vaccine advisory committee earlier this year.

The approval is narrower than the old “everyone six months and up” language people may remember. Current FDA product labels approve the vaccines for adults 65 and older and for younger people with at least one underlying condition that raises their risk of severe COVID; the minimum age varies by product. Spikevax goes down to 6 months, Comirnaty to age 5, and mNEXSPIKE and Nuvaxovid to age 12.

This is product approval, not individualized medical advice and not the same thing as a CDC recommendation for every person. The practical news is that manufacturers now have the regulatory clearance needed for the updated fall supply. If you’re deciding whether the 2026–27 shot makes sense for you or your family, use the current CDC guidance and your own healthcare provider rather than a headline about what FDA approved.

There’s a theme running through this morning’s stories that I like because none of it requires pretending technology is magic. A WordPress patch can fix a catastrophic vulnerability and still break a widget. Patching ordinary software can stop a nation-state intrusion. AI can help classify sensitive files, but somebody still needs to write the access rules. A coding tool can keep working even when two vendors decide they can’t stand each other anymore, provided you understand the dependency. And a vaccine formula can be technologically updated without turning an FDA approval into a blanket recommendation for everybody. The details are usually where the useful story is hiding.

Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.

Sources / Further Reading

Related Posts

Leave a Reply

Only people in my network can comment.