Release announcements, threat intelligence updates, and security news from the ReportedIP team.
Hive 2.1.36 makes hardware security keys a first-class second factor: one shared WebAuthn panel on all three sign-in surfaces, a multi-key manager with model detection, cloned-key alerts and a rebuilt profile 2FA section.
Read moreThe community-driven blacklist crossed 20,000 high-confidence threat IPs on July 27, 2026: +4,518 IPs in 30 days, with 87.7% of listed addresses attacking CMS login pages.
Read moreThe first quarterly ReportedIP WordPress Attack Report: 1.69 million attacks from 206,388 unique IPs in 82 days, the wp2shell case study, and what it means for WordPress operators.
Read moreOne category filter turns the ReportedIP blacklist into five port-scoped firewall block lists for SSH, mail, web and FTP - pulled hourly with ETag support, and fed back through fail2ban reporting.
Read morewp2shell chains two WordPress core CVEs into unauthenticated RCE. ReportedIP Hive 2.1.25 blocks the attack pattern at the WAF layer on every plan, free included.
Read moreHive 2.1.21 caps a 17-release run that hardened the new WordPress firewall: pre-WordPress WAF auto-covering nginx, backend exceptions, and a fix for auto-blocking that silently failed on non-UTC databases.
Read moreReportedIP honeypot server v1.3.0 makes webhooks configurable: post every attack detection to any API, your SIEM, Slack, Discord, or straight to AbuseIPDB.
Read moreHow Hive's WordPress firewall inspects every request, ships Ed25519-signed rules from a server feed, and guards against ReDoS, the engine and baseline are free on every plan.
Read moreHive 2.1.4 brings a request-inspecting Web Application Firewall, verified-bot detection, disposable-email blocking and a comment honeypot, everything that shipped since 2.0.22.
Read moreFive releases in one roundup: a Hide-Login probe sensor that blocks scans of your old login URL, a complete German interface, and a 2FA login flow that no longer sends codes you never requested.
Read moreGive every web, mail, and edge node in your cluster one shared community blocklist, queried over DNS with a single token, no per-node integration code.
Read moreThe ReportedIP community blacklist is now a live DNS blocklist. Query 11,134 listed IPs as a private RBL zone from Postfix, Rspamd, or any firewall, bookable from PRO.
Read more
