The Wordfence Q2 2026 Quarterly WordPress Threat Intelligence Report has been published. Here are some of the most important findings: • 2,073 Total Vulnerabilities Published (-24.3% from previous quarter) • 182 High Threat Vulnerabilities (+15.2% from previous quarter) • 357 Common & Dangerous Vulnerabilities (+80.3% from previous quarter) • 10.4B WAF Attacks Blocked (+14.3% from previous quarter) • 18.2B Brute Force Attacks Blocked (+13.8% from previous quarter) • 573K Sites Infected (+21.0% from previous quarter) Read the full report for more data and insights: wordfence.com/blog/2026/09/q…

PHP2Shell Update: Still No Confirmed WordPress Compromises - Here's what we've seen from protecting over 5 million WordPress sites: As of October 28, 2026, Wordfence is not aware of any WordPress site compromises through PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We continue to see PHP2Shell-related requests across the more than 5 million sites we protect. Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities. That does not make an unpatched server safe. The fix is still to update PHP on your server to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor package confirmed to contain both fixes) and restart PHP. Updating WordPress does not update PHP. Read more in the full post here: wordfence.com/blog/2026/10/p…

Introducing the Wordfence Threat Response Team: A New Way to Report Active Threats in the WordPress Ecosystem wordfence.com/blog/2026/10/i…

Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 and restart every PHP worker as soon as possible. hubs.li/Q04C5sXR0

Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found wordfence.com/blog/2026/10/c…

PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible. wordfence.com/blog/2026/10/p…

🚨 Two Critical PHP Vulnerabilities: Security Update Scheduled for October 21 — What WordPress Site Owners Need to Know wordfence.com/blog/2026/10/p…

Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator wordfence.com/blog/2026/10/w…

PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites wordfence.com/blog/2026/10/u…

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026) wordfence.com/blog/2026/10/w…

600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin Update Backuply to version 1.5.9 as soon as possible. wordfence.com/blog/2026/10/6…

Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs Into Thumbnails on Your Server Update Ghostscript to version 10.08.0 or later as soon as possible. wordfence.com/blog/2026/10/w…

The Web is built on the assumption that some math problems are too hard to solve. That assumption depends on our current knowledge of math, and that knowledge just jumped by around 700 proofs in a day. wordfence.com/blog/2026/10/c…

Weekly WordPress Vulnerability Report: September 14-20, 2026 Last week brought 358 vulnerabilities across 243 WordPress plugins and 4 WordPress themes. Read the full report: wordfence.com/blog/2026/09/w…

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core Update to 7.1.2 or your branch's fix now. A path traversal flaw in WordPress Core lets an attacker with no account make the site include a readable PHP file from outside the active theme directory. On some sites that can lead to remote code execution and full site compromise. Read Full Report: wordfence.com/blog/2026/09/p…

We analyzed a stealthy WordPress must-use plugin that hides itself and a rogue admin account from the dashboard and REST API, harvests plaintext admin passwords, restores itself after deletion, and exfiltrates data via an Ethereum smart contract. wordfence.com/blog/2026/09/i…

Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server wordfence.com/blog/2026/09/w…

100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS Update Tutor LMS to version 4.0.8 as soon as possible. wordfence.com/blog/2026/09/1…

Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin Update Wholesale Lead Capture to version 2.0.3.2 as soon as possible. wordfence.com/blog/2026/09/a…