On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any confirmed compromises resulting from these vulnerabilities, which is a clear indicator of this exploit's complexity considering Wordfence secures over 5,000,000 WordPress websites. We are continuing to closely monitor the situation and will share additional details as they become available.
Read the original article:
Attacks on PHP2Shell Continue, But No Known Compromises as a Result Yet