PHP maintainers announced Monday that patches for two vulnerabilities, each rated 9.2 out of 10 in severity, would be released within about 12 hours. The advisory followed leaked, unconfirmed details of an exploit tool called PHP2Shell demonstrated against popular PHP-based platforms including WordPress, Magento, Drupal, and Joomla. Security firm watchTowr said the flaws, tracked as CVE-2026-109618 and CVE-2026-109619, appear to affect every PHP version since PHP 5 in 2004 and that it has confirmed they are genuine.
WordPress plugin maker TeamUpdraft disclosed that attackers breached its website over the weekend of October 17-18 and accessed its customer database, including password hashes, two-factor authentication settings, and connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone. The company says payment data was not stored and was unaffected, and that UpdraftPlus plugin files remain untouched, but researcher Oliver Sild of Patchstack says stolen keys are already being used to backdoor WordPress sites.
Rank Math says some downloads of its paid SEO plugin, version 3.0.123, between October 15 at 20:02 UTC and October 16 at 07:12 UTC contained malware capable of implanting hidden backdoors once activated. The vendor pulled the affected files and issued a clean version, 3.0.124, while the free Rank Math SEO plugin used by over 4 million sites was not affected.
Wordfence researchers using their Argus AI system found a critical heap buffer overflow in Ghostscript, the PostScript/PDF rendering engine used by tools like ImageMagick and WordPress's thumbnail generator. A malicious PDF embedding a JPEG 2000 image can force Ghostscript to write far more data than a buffer can hold, corrupting memory and allowing unauthenticated remote code execution. The bug affects Ghostscript versions 9.21 through 10.07.1 and was confirmed present across ten tested Linux distributions and an official WordPress Docker image.
Automattic has confirmed that interim CFO Jeremy Klaperman has left the company, roughly three weeks after taking the role. Klaperman had previously served as CFO of Automattic's VIP Enterprise unit and stepped into the interim finance chief role following a governance crisis in which the entire board exited. No permanent CFO replacement has been named.
Patchstack researchers found hackers exploiting stored XSS vulnerabilities in two unrelated WordPress plugins—Ninja Forms (CVE-2026-94504) and WPC Product Bundles for WooCommerce (CVE-2026-93836)—to plant backdoors and create rogue admin accounts. The campaign, first spotted October 4 against WPC Product Bundles users and a day later against Ninja Forms, injects a malicious script from 'imgcdn1[.]com' into order data or form submissions that executes when an administrator views it, installing a fake plugin disguised as 'WP Smart Thumbnails.'
A blog post observes a recurring pattern of people announcing departures from platforms like Reddit, WordPress, Discord, GitHub, Codeberg, and Photoshop, often moving toward smaller, self-hosted sites or alternative networks such as Gopher and Gemini. Cited reasons include pricing changes, AI training on user content, ownership changes, and a general sense that platforms no longer serve individual users. The author notes these moves trend toward reduced reach but greater control rather than toward bigger replacement platforms.
Automattic, the company behind WordPress.com, has reportedly overhauled its board of directors after an attempt by prior board members to remove CEO Matt Mullenweg did not succeed. New board members, advisers and legal counsel have reportedly been brought in as part of the shakeup.
Automattic CEO Matt Mullenweg has assembled a new board, informing staff via Slack on Friday. The lineup includes author Hugh Howey, 'Breakup Bootcamp' writer Amy Chan, and IRL co-founders Henry Khatachryan and Krutal Desai, along with several new advisers. This follows an episode earlier this month in which the prior board briefly placed Mullenweg on leave before he regained control and removed or accepted resignations from those directors.
Patchstack disclosed a cross-site request forgery flaw in the Elementor Website Builder plugin, affecting versions 4.3.0 and 4.3.1, used on up to 2 million WordPress sites. The bug let attackers trick a logged-in administrator into clicking a malicious link that silently created a new admin account under attacker control. Elementor patched the issue in version 4.3.2, released two days after Patchstack's report.
Security firm Patchstack says threat actors began exploiting a critical WordPress path traversal flaw, CVE-2026-87902, to write files that execute shell commands, after initial reconnaissance traffic surged tenfold. The bug, discovered by researcher Robert Ressl and rated 9.2/10 in severity, allows unauthenticated attackers to trick get_page_template() into loading arbitrary local PHP files under certain theme and server configurations. WordPress patched the issue in version 7.1.2 and backported fixes to branches as old as 4.7.
GreyNoise's Global Observation Grid detected a Chinese-speaking threat actor exploiting flaws in ZyXEL GS1900 switches and WordPress's wp2shell vulnerabilities to compromise 996 devices and steal over 18,500 records. The group, linked to the Red Heron actor previously tied to a Gitea flaw, breached at least 49 organizations across 29 countries since early June 2026, including an unnamed Western government agency.
GoKawiil