Tagged: sysadmin.

PHP2Shell: if your site runs on WordPress, update PHP, not the plugins

Two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10, were fixed on 21 October after the details leaked a day early, and attack attempts started within hours. Updating WordPress or its plugins does not cover them; only the PHP version does. What happened, who is affected, how to check your own site in five minutes, plus the nginx fixes of 14 October and the npm worm of this month.

#security #php #nginx #npm #sysadmin #news