Wordfence Intelligence’s weekly reports for 2026 add up to 9,184 new vulnerabilities across 40 weeks, about 230 a week. The number keeps climbing, from 179 a week between January and June to 324 since July, and 512 and 655 in the last two weeks we checked. Most are in plugins, though in some weeks themes take a large share too.

A separate report counted about 11,000 for all of 2025 by its own method, so the totals are not directly comparable. Because the flaws are mostly in plugins, keep every plugin updated and remove the ones you don’t use. Wordfence’s API and CLI scanner are free, including for commercial use, and can check a site’s plugins against the database automatically, which beats reading the feed by hand.

PHP 8.1 has had no security fixes since December 31, 2025, and PHP2Shell showed what that means. For 8.1 and older the PHP project released no update, only minimal patches to build from source, so owners have to ask their host for a backport or move to a supported version.

The next date is close, because the 8.2.35 announcement says 8.2 stops receiving security fixes on December 31, 2026. According to php.net, 8.3 is supported until the end of 2027, 8.4 until the end of 2028 and 8.5 until the end of 2029. WordPress 7.x still runs on PHP 7.4, so a site can stay on an unpatched version for years, which is why PHP should be kept on a current, supported version and upgraded before the old one reaches its end date.

Since October 18, backdoor plugins have been installed on sites connected to UpdraftCentral, and the cause is not a bug in UpdraftPlus. The attacker had genuine connection keys, and TeamUpdraft believes its customer database, where those keys are stored, was accessed.

UpdraftPlus 1.26.12 revoked keys created before the incident and 1.26.13 fixed how the revocation was applied, so you need 1.26.13 or later. The update was pushed automatically, but it does not remove a backdoor that is already installed. One analysis advises looking for plugins described as “Small maintenance toolkit: keeps option storage tidy” and for Editor users who have been given manage_options and install_plugins, an account missing from the administrator list.

PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. They fix CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS 4.0), which allow code execution on the server without logging in. The flaw is in PHP itself, so almost any WordPress site is exposed, whatever its version. Wiz showed working attacks on current WordPress, Drupal and Joomla images, and Patchstack logged exploitation reports hours before the patches were published.

The fix is a PHP update, and WordPress.org says no core update is needed. Managed hosts will do it for you, while on a VPS it’s up to you. PHP 8.1 and older got no release at all. PHP suggests setting session.upload_progress.enabled=0 as a stopgap, but calls updating the only safe choice.

Neal Agarwal’s I’m Not a Robot is 48 CAPTCHAs in a row, with a certificate at the end declaring you a human being. GPT-6 Astra played it start to finish and got the certificate. Every level is a new interface with rules nobody explains, and the model figured out what each one wanted and clicked. CAPTCHAs only ever worked because machines couldn’t do that.

We’ve kept them around out of habit for a while now. If a checkbox is the only thing between your signup form and a thousand fake accounts, you should probably assume it’s decorative.