PHP2Shell, the UpdraftCentral key theft and malware in Rank Math PRO
Two critical PHP flaws took websites offline around the world, stolen UpdraftCentral keys were used to backdoor WordPress sites and a Rank Math PRO update shipped with malware.
Every WordPress site runs on PHP, so this was a big week. Two critical flaws in PHP made the national news, and websites around the world went offline while they were patched. The fix is on your server, not in your dashboard, so the job this week is to make sure your host has done it.
Two well-known plugin companies were also breached. If your site was ever connected to UpdraftCentral, update UpdraftPlus today and check for plugins and admin accounts you don't recognise. And if you use Rank Math PRO, check whether you installed version 3.0.123 on the night of 15 October.
PHP2Shell: the PHP flaw that took websites offline
Two critical PHP bugs, and the details leaked early
PHP is the programming language WordPress is written in, and it runs on your hosting server. On Wednesday 21 October the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical bugs that can let someone run their own code on a server without logging in.1 Details had started leaking online the day before, so attackers and defenders found out at about the same time.2
It quickly went beyond the tech press. Reuters reported that government sites in the Netherlands, Germany, France, Belgium and Finland were taken offline as a precaution, along with parts of Wikipedia, and Silicon UK said the BBC switched off some of its programme pages and the City of Edinburgh Council took its whole website down.34 The UK's National Cyber Security Centre told organisations that can't patch quickly to consider taking systems offline.5 WordPress.org repeated that advice for anyone running their own server on PHP older than 8.2.6
Lots of attack attempts, no confirmed break-ins yet
Attackers are trying hard. Amazon spotted an attempt on 17 October, four days before the fix came out, and Wordfence had blocked more than 74,000 attempts by Thursday.78 But Wordfence also said it hadn't seen a single confirmed break-in, and in its own tests the attack only ran code on a specially prepared test server.89 So it's hard to pull off, but nobody should treat an unpatched server as safe.
The fix comes from your host, not a WordPress update
Updating WordPress, plugins or themes won't fix this, because it's not WordPress code. On shared and managed hosting your host updates PHP, and hosts across the WordPress world spent Wednesday and Thursday rolling out fixes.10 Automattic says WordPress.com, WordPress VIP, Pressable and WP Cloud were protected straight away.11
To check, go to Tools › Site Health › Info › Server in your dashboard to see which PHP version your site runs. Hosts sometimes patch without changing the version number, so the reliable check is to ask them: "Is the PHP serving my site patched for PHP2Shell, and has it been restarted?"9
If you're on PHP 8.1 or older, there's no official fix from the PHP project.1 Ask your host to move you to PHP 8.3 or newer. Take a backup first and test on a staging copy if you can, because old plugins and themes can break on newer PHP. If something does break, my guide to the WordPress critical error screen will help.
On Friday PHP also warned about a related bug that only matters with an unusual setup WordPress doesn't use, and it'll be fixed in the next normal release.12 Some hosts may turn off a little-used PHP upload progress setting because of it, which you won't notice.
WordPress news
WordPress 7.2 beta 1 is out
The first beta of WordPress 7.2 came out on Tuesday, with the final release due on 8 December.13 For site owners, the highlights are text shadows, more design settings that can change by screen size, notes in the editor margin, a new "On This Day" dashboard widget and images that get resized in your browser before they upload. Developers get a new Secrets API, a standard way for plugins to store API keys and other credentials.13 Suggestion mode, for proposing edits in the editor, has been pushed back to 7.3.14
As always, test it on a staging copy, not your live site.
For developers
The AI team has Matt Mullenweg's go-ahead to make MCP, the system AI assistants use to connect to tools, a standard part of WordPress. The details of how it ships are still being worked out.15
WooCommerce
WooCommerce 11.3 changes how AI assistants connect
There was no WooCommerce release this week. If you've connected an AI assistant to your shop through WooCommerce's own MCP endpoint, that endpoint goes away in WooCommerce 11.3. You'll need to switch to the WordPress MCP Adapter plugin and an application password before you update.16 Most shops don't use it and have nothing to do.
Plugin security updates
Stolen UpdraftCentral keys were used to backdoor sites
TeamUpdraft, which makes UpdraftPlus, found that its website had been broken into over the weekend of 17 and 18 October and its customer database accessed.17 That database held the keys that link sites to UpdraftCentral, its dashboard for managing many sites from one place. The attacker used those keys to create admin accounts and install malicious plugins on connected sites.1718
UpdraftPlus itself (on about 3 million sites) wasn't tampered with, and backups in your own Google Drive, Dropbox or S3 weren't touched.17 If your site was never connected to a TeamUpdraft account, you don't need to do anything for this. Updating is still a good idea. If you have a teamupdraft.com account, change its password, plus anywhere else you used the same one, and reset its two-factor login. If you find anything odd, TeamUpdraft suggests restoring from a backup taken before 17 October, and my hacked site clean-up guide covers the rest.
Rank Math PRO 3.0.123 shipped with malware
Rank Math says attackers got into its systems and swapped in a booby-trapped copy of Rank Math PRO 3.0.123. It was available from 20:02 UTC on 15 October to 07:12 UTC on 16 October (about 9pm to 8am UK time), and Rank Math told The Repository it reached several hundred customers.1920 Rank Math put out a clean 3.0.124 on 16 October, but most of the details only came out this week. The free Rank Math plugin from WordPress.org wasn't affected.19
Other fixes this week
I haven't seen reports of attacks on any of these, but if you use them, update:21
| Plugin | Sites | What's wrong | Fixed in | Action |
|---|---|---|---|---|
| LiteSpeed Cache | 7 million+ | With HTML optimisation on, a published comment could run code in visitors' browsers | 7.9.2 | Update |
| Duplicator | 1 million+ | A booby-trapped comment could run code on your server when you migrate the site | 5.0.0 | Update |
| Kirki | 500,000+ | Anyone could read users' email addresses and profile details, on some page setups | 6.4.0 | Update |
| PixelYourSite | 400,000+ | On cached sites, anyone could sneak harmful code into pages other visitors see | 11.4.3 | Update |
| CleanTalk Anti-Spam | 200,000+ | A fake sign-up could plant code that runs when you check its spam user list | 6.90 | Update |
| LatePoint | 100,000+ | Anyone who knows a customer's email or phone number could log in as them | 5.7.5 | Update now |
| ACF Extended | 100,000+ | Some front-end form setups let anyone take over an admin account or run code | 0.9.2.8 | Update now |
| LearnPress | 70,000+ | Anyone could slip harmful data in through the course checkout | 4.4.11 | Update now |
| User Registration & Membership | 50,000+ | Anyone could run shortcodes on restricted pages | 5.3.0 | Update |
Duplicator's fix actually came out on 8 September, but Wordfence only published the details on Tuesday.22 Updating doesn't fix packages you made with older versions, so make a fresh one before your next migration. Essential Addons for Elementor, on more than a million sites, fixed two smaller bugs in 6.8.7, and TI WooCommerce Wishlist 2.13.0 stopped strangers reading private wishlists through its API.21 If you're not sure how to handle any of this, see my guide to dealing with a plugin security vulnerability.
For the long tail, Wordfence's report for 12 to 18 October counted 497 new vulnerabilities across 327 plugins and 23 themes.23
What I'd do this week
- Ask your host whether PHP is patched for PHP2Shell and check your version under Tools › Site Health › Info. If you're on PHP 8.1 or older, book in a move to 8.3 or newer.
- Using UpdraftCentral? Update UpdraftPlus to 1.26.13 on every connected site, then check each one for unfamiliar plugins and admin users.
- Using Rank Math PRO? Make sure you're on 3.0.124, and find out whether 3.0.123 was installed on the night of 15 October.
- Update LatePoint, ACF Extended and LearnPress if you use them, then the rest of the table.
- Make sure you have a recent backup you can restore. It's the thing that saves you in a week like this. If an update breaks something, here's how to fix a site after a bad update.
Security advisory: Critical remote code execution vulnerabilities, update now, PHP, 21 October 2026. ↩ ↩
PHP2Shell FAQ: CVE-2026-109618 & CVE-2026-109619, watchTowr, 23 October 2026. ↩
Factbox: Websites taken offline over PHP risks, Reuters via The Star, 21 October 2026. ↩
Sites Go Dark As Admins Rush To Patch PHP Flaw, Silicon UK, 22 October 2026. ↩
Critical security issue affecting PHP, National Cyber Security Centre, 21 October 2026. ↩
Critical PHP Security Release, WordPress.org, 21 October 2026. ↩
Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot, AWS Security Blog, 21 October 2026. ↩
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet, Wordfence, 22 October 2026. ↩ ↩
Why It's Urgent to Update PHP on Your WordPress Site, Wordfence, 21 October 2026. ↩ ↩
PHP Patches Critical PHP2Shell Vulnerabilities as Hosts Across the WordPress Ecosystem Race to Protect Customers, The Repository, 22 October 2026. ↩
Critical Security Releases for PHP, WooCommerce Developer Blog, 21 October 2026. ↩
Informational advisory: Session upload progress, PHP, 23 October 2026. ↩
WordPress 7.2 Beta 1 is Ready for Download and Testing, WordPress.org, 20 October 2026. ↩ ↩
WordPress 7.2 Beta 1 Out Now With Secrets API and Notes Upgrades, Punts Suggestion Mode to 7.3, The Repository, 21 October 2026. ↩
AI Contributor Weekly Summary, 21 October 2026, Make WordPress AI, 22 October 2026. ↩
WooCommerce 11.3 MCP Adaptor updates, WooCommerce Developer Blog, 21 October 2026. ↩
Security incident, October 2026, TeamUpdraft, 19 October 2026 (updated 23 October). Fixed versions confirmed in the UpdraftPlus changelog on WordPress.org. ↩ ↩ ↩
PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites, Wordfence, 19 October 2026. ↩
Rank Math PRO 3.0.123 security incident, Rank Math. Clean version confirmed in the Rank Math changelog. ↩ ↩
Rank Math Confirms System Breach Delivered Malware to Several Hundred PRO Customers, The Repository, 20 October 2026. ↩
National Vulnerability Database, NIST, with records from Wordfence and WPScan published 17 to 23 October 2026. Fixed versions checked against each plugin's changelog on WordPress.org. ↩ ↩
Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator, Wordfence, 20 October 2026. ↩
Wordfence Intelligence Weekly WordPress Vulnerability Report, 12 to 18 October 2026, Wordfence, 23 October 2026. ↩
