// stack
PHP
Security incidents affecting pHP, plus apps and CMSs built on it (WordPress, Drupal, Joomla, Magento). Newest first.
- incidents
- 10
- live
- 1
- patched
- 8
## 10 PHP incidents in the last year
through Oct 22, 2026- highclosedpartial fixclosed Oct 20, 2026
TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored
› UpdraftPlus / UpdraftCentral (WordPress)
UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral.
- criticallivepartial fixsince Oct 17, 2026
PHP2Shell: critical unauthenticated RCE in PHP core
› PHP
Two critical remote-code-execution flaws in PHP core (CVE-2026-109618 and CVE-2026-109619, aka “PHP2Shell”) were disclosed early after an embargo leak. Both score CVSS 9.2 and can let an unauthenticated attacker run code on servers serving PHP web requests, especially Apache mod_php. Patches shipped Oct 21 2026 (appliance vendors such as QNAP are still preparing fixes); exploitation attempts were observed before and after the patch, and watchTowr / AWS report active scanning.
CVE-2026-109618CVE-2026-109619 - criticalclosedpatchedclosed Oct 16, 2026
Rank Math PRO WordPress plugin download backdoored
› Rank Math PRO (WordPress)
SEO plugin vendor Rank Math confirmed attackers tampered with PRO version 3.0.123 on the official download site, planting hidden backdoors during an ~11-hour window. Sites that installed that build should audit and rebuild.
highWordPress Core: WordPress Core Remote File Inclusion Vulnerabilitypatched
› WordPress Core patched
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.
open incident →CVE-2026-87902highAdobe Commerce and Magento : Adobe Commerce and Magento Incorrect Authorization Vulnerability patched
› Adobe Commerce and Magento patched
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. Added to CISA KEV on 2026-09-24.
open incident →CVE-2026-71362
show 5 older incidents5 older incidents
September 2026 1
highAdobe Commerce and Magento: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerabilitypatched
› Adobe Commerce and Magento patched
Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. Added to CISA KEV on 2026-09-08.
open incident →CVE-2026-75650
July 2026 2
highWordPress Core: WordPress Core SQL Injection Vulnerabilitypatched
› WordPress Core patched
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation.
open incident →CVE-2026-60137 · CVE-2026-63030highJoomlack Page Builder: Joomlack Page Builder Improper Access Control Vulnerabilitypatched
› Joomlack Page Builder patched
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. Added to CISA KEV on 2026-07-07.
open incident →CVE-2026-56290
June 2026 1
highWidget Factory Joomla Content Editor : Widget Factory Joomla Content Editor Improper Access Control Vulnerabilitypatched
› Widget Factory Joomla Content Editor patched
Widget Factory Joomla Content Editor contains an improper access control vulnerability which could allow for upload and execution of PHP code via the creation of new editor profiles for unauthenticated users. Added to CISA KEV on 2026-06-16.
open incident →CVE-2026-48907
May 2026 1
highDrupal Core: Drupal Core SQL Injection Vulnerabilitypatched
› Drupal Core patched
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. Added to CISA KEV on 2026-05-22.
open incident →CVE-2026-9082
