PHP2Shell Update: Still No Confirmed WordPress Compromises, and Answers to the Questions We’re Hearing Most

by

TL;DR: As of October 28, 2026, Wordfence is not aware of any WordPress site compromised through PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We continue to see PHP2Shell-related requests across the more than 5 million sites we protect. Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident … Read more

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)

by

Last week, there were 268 vulnerabilities disclosed in 182 WordPress Plugins and 15 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 124 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with … Read more

WordPress 7.1.4

by

This security release features fixes for multiple issues. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.4 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will … Read more

WordPress 7.2 Beta 2 

by

WordPress 7.2 Beta 2 is ready for download and testing!  This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features. How to Test WordPress 7.2 Beta … Read more