What to Do About PHP2Shell: A Free Guide for Site Owners
whattodoaboutphp2shell.com is a free guide from WP Care: check your PHP version, see which versions are fixed, and know what to ask your host.
Read More
whattodoaboutphp2shell.com is a free guide from WP Care: check your PHP version, see which versions are fixed, and know what to ask your host.
Read More
PHP released fixes for two critical flaws on 21 October 2026. What it means for WordPress sites, and why sites on old PHP versions are most at risk.
Read More
Stolen UpdraftCentral keys were used on 18–19 October 2026 to install backdoor plugins on WordPress sites. Who is exposed and what to do.
Read More
Contact Form 7 6.2 raised its minimums from PHP 7.4 to 8.3 and WordPress 6.7 to 7.1. What happens to sites below the bar, and where it can still...
Read MoreWordPress 7.1.3, released 6 October 2026, fixes seven security issues in core, including two cross-site scripting flaws and a SQL injection in export.
Read More
WordPress 7.1.2, released 22 September 2026, fixes a critical unauthenticated file inclusion flaw. It is the fifth core security release since 17 July.
Read More
Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, up 42%. Our own analysis of the CVE record shows 2026 running level, not higher.
Read More
WordPress 7.1 changed how hook callbacks are identified. On sites running WP Rocket and Elementor Pro under PHP 8, that is a fatal error — often hidden behind a...
Read More
Elementor Pro 4.2.2, released 19 August 2026, fixes a CVSS 9.0 flaw letting anyone upload PHP files through a Form upload field. What it means for your site.
Read More
WordPress 7.0.4, released 12 August 2026, fixes a remote code execution flaw — the third core security release in four weeks. What it means for your site.
Read More