The Exit Log
Tagged
security
security
PHP2Shell (CVE-2026-109618): the critical flaw under every WordPress site, and who has to patch it
Two critical flaws in PHP itself, rated CVSS 9.2, let one unauthenticated request take over a server before WordPress even loads. No plugin or WordPress update fixes them. Which PHP versions are fixed, how to check yours, what your host is doing, and what to do if you are on PHP 8.1 or older.
security
UpdraftPlus backdoor: when your backup plugin installs the attacker's plugin
An attacker broke into TeamUpdraft over the weekend of October 17 and used stolen UpdraftCentral keys to install backdoor plugins on WordPress sites, skipping the login form and 2FA. Who is exposed, what to check today, and why the same week also brought a poisoned Rank Math PRO update and PHP2Shell.
security
CVE-2026-94504: the Ninja Forms flaw where the attacker fills in your contact form
Ninja Forms (500,000+ sites) has an unauthenticated stored XSS that is being exploited since October 5. The attacker submits your form, you open the submission, and a script installs a fake plugin, two admin accounts, a secret login URL and a file manager. Here is what to check.
security
CVE-2026-87902: the WordPress core flaw exploited the day it was patched
A 9.2 critical in WordPress core itself, not a plugin. Every version since 4.7 (2016) is affected, and attacks started hours after the September 22 fix. Here's what to check and who is actually exposed.
security
This month in WordPress vulnerabilities: August 2026
August 2026's WordPress security roundup: Everest Forms (100,000+ sites, unauthenticated file upload) and User Profile Builder (40,000 sites, admin takeover) — what to check on your site right now.
data
Is WordPress safe in 2026? What 11,334 new vulnerabilities tell us
WordPress core is reasonably secure, but 91% of the 11,334 vulnerabilities disclosed in 2025 came from plugins. Here's where the risk actually lives, how fast it's exploited, and who should worry.
security
Hacked WordPress site? Do these 6 things in the next hour
A calm, step-by-step triage guide for a hacked WordPress site: contain the damage, preserve evidence, and decide clean-up vs. rebuild — in that order.
migration
Malware clean-up vs. migration: the real cost over 3 years
Cleanup is cheaper today; it's rarely cheaper by year two. The honest 3-year math on staying with WordPress versus migrating once to a platform with nothing left to patch.
Free audit · 20-minute call · No obligation
Make this the last patch
you ever install.
Drop your URL. You'll see your plugin count, known-vulnerable plugins and what the stack costs you a month - then pick a time to go through it together. You leave with a plan either way: a fixed quote, or honest advice to stay put.