PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites

by

TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information. Public analysis by Nethemba and reports submitted directly to Wordfence have documented attackers using … Read more

Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

by

On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has more than one million active installations. The vulnerability is tracked as CVE-2026-82814 and carries a CVSS 3.1 score of 8.8 (High). This is a second-order vulnerability. An unauthenticated attacker … Read more

PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now

by

The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The PHP project says all PHP users are strongly encouraged to update immediately. We recommend making sure every site you manage is running a patched version of PHP as … Read more

Critical PHP Security Release

by

The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place … Read more