Guides
Clear articles on DNS, email, migrations, infrastructure, and the day to day operational issues we handle in real environments.
Start with the area that matches your issue or project.
Practical reads to help troubleshoot, plan, and make better infrastructure decisions.
HTTP/2 Bomb (CVE-2026-49975) is a remote denial-of-service vulnerability affecting the default HTTP/2 configurations of NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. It can crash a web server with 32 GB of memory in roughly 20 seconds from a home internet connection. LiteSpeed Web Server, OpenLiteS
Read guideA second privilege-escalation vulnerability in the LiteSpeed User-End cPanel Plugin is being actively exploited in the wild. This is separate from the May 19 issue. Fix: upgrade to LiteSpeed WHM Plugin v5.3.2.1 (which bundles User-End v2.4.8) or uninstall the plugin. This guide explains the issue, the compromise check,
Read guidecPanel released an emergency Technical Support Release (TSR) on May 19, 2026 addressing two security issues identified as SEC-73728 and SEC-73755, alongside the actively-exploited LiteSpeed plugin vulnerability covered in a separate guide. This is the third cPanel emergency in three weeks. This guide explains the relea
Read guideA privilege-escalation vulnerability in the LiteSpeed User-End cPanel Plugin was actively exploited in the wild before disclosure. cPanel's May 19, 2026 emergency patch released 12 hours ahead of schedule and includes an automated fix that uninstalls the plugin entirely. This guide explains what happened, what it means
Read guideCVE-2026-46333, publicly known as ssh-keysign-pwn, is a Linux kernel information disclosure vulnerability disclosed by Qualys on May 14, 2026. It lets unprivileged users read root-owned files including SSH host private keys and /etc/shadow. This guide explains what it is, why the previous mitigations do not cover it, w
Read guideFragnesia (CVE-2026-46300) is a new Linux kernel local privilege escalation disclosed on May 13, 2026. It is the third such vulnerability in three weeks. This guide explains what it is, why the Dirty Frag mitigation already protects you, what Gotekky did on managed servers, and what self-managed CloudLinux and AlmaLinu
Read guideRecent technical articles and troubleshooting references from the Gotekky team.
HTTP/2 Bomb (CVE-2026-49975) is a remote denial-of-service vulnerability affecting the default HTTP/2 configurations of NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora. It can crash a web server with 32 GB of memory in roughly 20 seconds from a home internet connection. LiteSpeed Web Server, OpenLiteS
Read guideAfter updating to cPanel 134.0.34, accessing a cPanel user account from a root or reseller WHM session triggers an infinite 2FA prompt loop. cPanel confirmed this as a known bug under developer case CPANEL-53684 and shipped fixes in 11.134.0.35 and equivalent builds for the 11.136, 11.126, and 11.110 ELS branches. This
Read guideA second privilege-escalation vulnerability in the LiteSpeed User-End cPanel Plugin is being actively exploited in the wild. This is separate from the May 19 issue. Fix: upgrade to LiteSpeed WHM Plugin v5.3.2.1 (which bundles User-End v2.4.8) or uninstall the plugin. This guide explains the issue, the compromise check,
Read guidecPanel released an emergency Technical Support Release (TSR) on May 19, 2026 addressing two security issues identified as SEC-73728 and SEC-73755, alongside the actively-exploited LiteSpeed plugin vulnerability covered in a separate guide. This is the third cPanel emergency in three weeks. This guide explains the relea
Read guideA privilege-escalation vulnerability in the LiteSpeed User-End cPanel Plugin was actively exploited in the wild before disclosure. cPanel's May 19, 2026 emergency patch released 12 hours ahead of schedule and includes an automated fix that uninstalls the plugin entirely. This guide explains what happened, what it means
Read guideCVE-2026-46333, publicly known as ssh-keysign-pwn, is a Linux kernel information disclosure vulnerability disclosed by Qualys on May 14, 2026. It lets unprivileged users read root-owned files including SSH host private keys and /etc/shadow. This guide explains what it is, why the previous mitigations do not cover it, w
Read guideFragnesia (CVE-2026-46300) is a new Linux kernel local privilege escalation disclosed on May 13, 2026. It is the third such vulnerability in three weeks. This guide explains what it is, why the Dirty Frag mitigation already protects you, what Gotekky did on managed servers, and what self-managed CloudLinux and AlmaLinu
Read guideWHMCS CVE-2026-29204 is a client area authorization bypass that affects every WHMCS version from 7.4 onward. Patches landed in WHMCS 9.0.4 and 8.13.3 on May 13, 2026. This guide explains what the vulnerability does, who is at risk, and how to update your WHMCS installation safely.
Read guideA new Linux kernel vulnerability called Copy Fail (CVE-2026-31431) lets any local user gain root in seconds. This guide explains what it is, who is at risk, what Gotekky has done about it on managed servers, and what self-managed VPS owners should do today.
Read guideCVE-2026-41940 is a critical authentication bypass in cPanel and WHM, exploited in the wild since February 2026. This guide explains what happened, what Gotekky did to protect managed servers, and what you should do if you operate your own cPanel infrastructure.
Read guideDirty Frag is a pair of Linux kernel vulnerabilities disclosed on May 7, 2026 that grants instant root on every major distribution. This guide explains what it is, why it bypasses the Copy Fail mitigation, what Gotekky has done about it on managed servers, and what self-managed operators on AlmaLinux, CloudLinux, RHEL,
Read guideThe domain name you choose affects your Canadian SEO, brand credibility, and long-term flexibility. This guide covers choosing between .CA and .com, what makes a strong Canadian business domain, and the mistakes worth avoiding.
Read guide
