Erik Kraijenoord Update, October 21, 2026: The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix both vulnerabilities. Read our new advisory for the fixed versions and what to do now. Editor’s note: This post was published on October 20, 2026, before the PHP security release. On October 21, we updated it to point … Read more
On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has more than one million active installations. The vulnerability is tracked as CVE-2026-82814 and carries a CVSS 3.1 score of 8.8 (High). This is a second-order vulnerability. An unauthenticated attacker … Read more
The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. The PHP project says all PHP users are strongly encouraged to update immediately. We recommend making sure every site you manage is running a patched version of PHP as … Read more
The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place … Read more
This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features. How to Test WordPress 7.2 Beta 1 You can test WordPress 7.2 Beta 1 in any of … Read more
