Erik Kraijenoord

Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet

by

On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any … Read more

PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites

by

TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information. Public analysis by Nethemba and reports submitted directly to Wordfence have documented attackers using … Read more

Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

by

On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has more than one million active installations. The vulnerability is tracked as CVE-2026-82814 and carries a CVSS 3.1 score of 8.8 (High). This is a second-order vulnerability. An unauthenticated attacker … Read more

PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now

by

The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The PHP project says all PHP users are strongly encouraged to update immediately. We recommend making sure every site you manage is running a patched version of PHP as … Read more