Erik Kraijenoord

On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website traffic. We first alerted WordPress site owners to these updates in our initial public service announcement. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and each … Read more

On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any … Read more

TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information. Public analysis by Nethemba and reports submitted directly to Wordfence have documented attackers using … Read more

On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has more than one million active installations. The vulnerability is tracked as CVE-2026-82814 and carries a CVSS 3.1 score of 8.8 (High). This is a second-order vulnerability. An unauthenticated attacker … Read more

Update, October 21, 2026: The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix both vulnerabilities. Read our new advisory for the fixed versions and what to do now. Editor’s note: This post was published on October 20, 2026, before the PHP security release. On October 21, we updated it to point … Read more