Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
About this summary. This is a short excerpt from the description that SecurityWeek published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.securityweek.com/php2shell-attacks-root-palo-alto-firewalls-but-fail-against-wordpress/
Source attribution: headline and facts are from SecurityWeek (securityweek.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an…
PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most
TL;DR: As of October 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We continue to see…
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Last week, there were 497 vulnerabilities disclosed in 327 WordPress Plugins and 23 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability…
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners…
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP…
PHP2Shell: Why websites are going offline for emergency security updates
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted…