News · via Malwarebytes Labs
The web’s having a rough week. Here’s how to browse safely
You recognize the website. You’ve visited it before. You may even have it bookmarked.
WordPress
Coverage tagged "WordPress".
News · via Help Net Security
DreamHost incident triggers password resets, locks customers out of email and FTP accounts
DreamHost has brought its File Manager back online after an incident that disrupted several of its services, though some of its customers still can’t get into their email or FTP accounts until…
News · via Wordfence
Introducing the Wordfence Threat Response Team: A New Way to Report Active Threats in the WordPress Ecosystem
When a new threat to WordPress sites emerges, the first hours matter most. Today we’re introducing the Wordfence Threat Response Team, led by Alex Thomas and made up of some of our most experienced…
News · via Security Affairs
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Auditing the auditor: Unmasking Apex…
News · via Wordfence
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Last week, there were 497 vulnerabilities disclosed in 327 WordPress Plugins and 23 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218…
News · via Wordfence
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet
On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became…
News · via Help Net Security
New PHP2Shell scanner checks your hosts for CVE-2026-109618 and CVE-2026-109619
Searchlight Cyber released php2shell-scanner, an open-source tool that tests whether a host is exposed to CVE-2026-109618 and CVE-2026-109619, the pair of PHP remote code execution bugs patched on…
News · via Wordfence
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found
On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website…
News · via Zscaler ThreatLabz
CVE-2026-109618 and CVE-2026-109619: PHP Vulnerable to Unauthenticated RCE Attacks
IntroductionOn October 21, 2026, two critical remote code execution (RCE) vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively referred to as “PHP2Shell,” were publicly disclosed. Both…
News · via Simon Willison
Today's PHP Security Release, and How We're Strengthening PHP Security
Today's PHP Security Release, and How We're Strengthening PHP Security If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote…
News · via SecurityWeek
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications.
News · via Wordfence
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The…
News · via Malwarebytes Labs
PHP2Shell: Why websites are going offline for emergency security updates
If you’ve encountered websites in maintenance mode today, it may be a security precaution. Reports of attacks targeting two critical PHP vulnerabilities have prompted warnings to install emergency…
News · via Krebs on Security
Widespread PHP Flaw May Cause Many Site Outages Today
Expect to see quite a few websites serving error pages today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full…
News · via Kaspersky Securelist
Critical RCE vulnerabilities in PHP (CVE-2026-109618, CVE-2026-109619)
Vulnerability overview On October 20, 2026, the PHP security team published a preliminary notice regarding an upcoming emergency release that addresses two critical vulnerabilities (both rated 9.2 on…
News · via Cisco Talos
Two critical RCEs in PHP core
Cisco Talos is tracking the disclosure of two unauthenticated remote code execution (RCE) flaws in PHP core, dubbed “php2shell”, triggered by a plain HTTP request and exploitable before any…
News · via Cloudflare
Cloudflare deploys protections against php2shell vulnerability
Today, Calif.io, Wiz, OpenAI and Quarkslab disclosed two vulnerabilities in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and known as php2shell. The vulnerabilities affect all web servers…
News · via CyberScoop
Prepare yourselves: PHP to release emergency fixes for 2 critical vulnerabilities
Update, 10/21/2026, 9:55 a.m.: The patches have been released, with fixes shipped as versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, covering the supported branches, 8.2 through 8.5. Our original story…
News · via SOCRadar
PHP2Shell: CVE-2026-109618 & CVE-2026-109619
PHP2Shell is the name researchers now use for two critical vulnerabilities in PHP, the server-side language behind WordPress, Drupal, Magento, Laravel, and many custom web applications. Tracked as…
News · via The Hacker News
Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites
Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to…