Security Blog Post 21st October 2026 - Effecting Lagom/WHMCS Services and WHMCS Global Services

[slim]

Can someone clarify if this is current or has someone jiggered with the post dates on your blog.?

https://www.whmcs.com/blog/security-alert/  - dated 21st Oct 2026. 

The dates on the blog appear to have quote a few n the 21st - so I would guess someone has stuffed the dates - these should be corrected asap. if this particular security incident is current, we need to know.

 

Edited 6 hours ago by slim

[WHMCS Carlos]

5 hours ago, slim said:

Can someone clarify if this is current or has someone jiggered with the post dates on your blog.?

https://www.whmcs.com/blog/security-alert/  - dated 21st Oct 2026. 

The dates on the blog appear to have quote a few n the 21st - so I would guess someone has stuffed the dates - these should be corrected asap. if this particular security incident is current, we need to know.

Hi Slim,

Nobody has edited any post dates. The page you landed on is not our live blog. It is the new version we are migrating to, and it is not finished: the import has not carried the original publish dates across yet, which is why every post on that page is showing 21 October 2026. It was not meant to be publicly reachable yet either, so the flag is useful on two counts.

Our live blog is blog.whmcs.com. That is the published one and the dates on it are correct.

On the part that matters, whether that security alert is current: it is not. It is from 8 March 2024. It was never about the WHMCS software itself, it concerned three third-party vendors and their extensions and themes. Here it is with its real date on it:

https://blog.whmcs.com/133747/security-alert

The migration should be finished in the next week or so. That unfinished copy is being taken out of public reach now, because a two year old security post wearing last week's date is the last thing anyone needs to stumble across at the moment.

Thanks for calling it out.