Wordfence

Wordfence

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)

Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to ...Read More

23 Oct 2026 · via Wordfence

Wordfence

Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet

On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any confirmed compromises resulting from these vulnerabilities, which is a clear indicator of this exploit's complexity considering…

22 Oct 2026 · via Wordfence

Wordfence

Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated code execution. Updating WordPress won't fix them. Update and restart PHP.

22 Oct 2026 · via Wordfence

Wordfence

PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now

The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. We recommend making sure every site you manage is running a patched version of PHP as soon as possible.

21 Oct 2026 · via Wordfence

Wordfence

PSA: Upcoming Critical PHP Security Release

The PHP security team has issued advance notice of an upcoming critical security release, scheduled for Wednesday, October 21, 2026 at 14:00 UTC (10:00 AM Eastern). The release fixes two critical vulnerabilities, both rated 9.2 on the CVSS v4.0 scale. PHP is the programming language WordPress is built on. Every WordPress site runs on a ...Read More

20 Oct 2026 · via Wordfence

Wordfence

Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

Wordfence Argus helped uncover CVE-2026-82814, a high-severity unauthenticated PHP object injection in Duplicator and Duplicator Pro. Update to version 5.0.0 or newer.

20 Oct 2026 · via Wordfence

Wordfence

PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites

TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information.

19 Oct 2026 · via Wordfence

Wordfence

PSA: Malware Found in Some Rank Math SEO PRO 3.0.123 Downloads

Rank Math has disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. According to Rank Math, the affected version was downloaded or installed through an update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. If an affected copy of Rank Math SEO PRO 3.0.123 was ...Read More

17 Oct 2026 · via Wordfence

Wordfence

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)

Last week, there were 655 vulnerabilities disclosed in 406 WordPress Plugins and 100 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 236 Vulnerability Researchers that contributed to WordPress Security last week.

15 Oct 2026 · via Wordfence