Quick answer: As of late October 2026, the two things every WordPress site owner should check are: are you running the latest WordPress 7.1.x security release, and has your host patched PHP against the PHP2Shell vulnerabilities fixed on October 21, 2026? After that, update plugins with known vulnerabilities and remove anything you no longer use. This page tracks the security news that matters, explains it in practical terms and links to official sources.
We update this hub every week. Each entry says what happened, who is affected and exactly what to do. When a story needs more depth, we write a full guide and link it here.
This week’s priorities (late October 2026)
| Priority | What to check | Who is affected | Action |
|---|---|---|---|
| 1 | PHP2Shell (PHP security fixes, October 21, 2026) | Sites on unpatched PHP builds | Ask your host to confirm PHP is patched, or update PHP yourself |
| 2 | WordPress core 7.1.x security releases | Sites still on 7.1.0–7.1.2 or older branches | Update to the latest 7.1.x point release |
| 3 | Plugin vulnerabilities | Sites running outdated or abandoned plugins | Update, replace or delete them |
| 4 | Admin accounts | Every site | Turn on two-factor authentication and remove old admin users |
PHP2Shell: patch PHP, not just WordPress
The biggest story this month sits below WordPress itself. On October 21, 2026, the PHP project shipped fixes for a pair of serious vulnerabilities nicknamed PHP2Shell. Because WordPress runs on PHP, a vulnerable PHP build can put a site at risk even when WordPress core and every plugin are fully updated.
What to do:
- Log in to your hosting dashboard and check your PHP version. Most hosts show it under “PHP Manager” or “Site Tools”.
- Ask your host’s support team in writing whether the patched PHP build is installed on your server. Managed hosts usually patch automatically; unmanaged VPS owners must do it themselves.
- If you manage your own server, update PHP through your package manager and restart PHP-FPM.
We explain the details, the affected versions and the safe update steps in our full guide: PHP vulnerability and WordPress: what to do.
WordPress core: stay on the latest 7.1.x release
WordPress 7.1 was released on August 19, 2026. Since then, point releases have followed: 7.1.1 (maintenance and security) on September 17, 7.1.2 on September 22 and 7.1.3 (maintenance and security) on October 6, 2026. Point releases fix vulnerabilities that are then disclosed publicly, so anyone still on an older build is easier to target.
To check your version, go to Dashboard → Updates in your WordPress admin. Minor (point) releases install automatically on most sites unless automatic updates were turned off by a plugin, the host or a line in wp-config.php. If your site is behind, back up first and then click Update now.
Official announcements are published on the WordPress.org news blog. That is the source to trust, not social media posts or emails claiming to be from WordPress.
Plugin vulnerabilities: where most real attacks happen
Core is rarely the weak point. Most compromised WordPress sites are hacked through an outdated plugin or theme. Researchers disclose new plugin vulnerabilities every week, and attackers scan for vulnerable sites within hours of disclosure.
Good habits that stop most plugin attacks:
- Update weekly. Turn on automatic updates for well-maintained plugins, or set a weekly update routine.
- Delete what you do not use. A deactivated plugin can still be exploited if its files are reachable.
- Avoid abandoned plugins. If a plugin has not been updated in a year or more, look for an alternative.
- Never install nulled plugins. Pirated premium plugins are a common way malware gets in.
- Use a vulnerability database. Wordfence Intelligence, Patchstack and WPScan all publish free advisories.
For the full process, read our WordPress vulnerabilities guide and work through the WordPress security checklist.
How we decide what goes on this page
There are dozens of WordPress-related advisories every week. Most affect small plugins with a handful of installs. We include an item when it meets at least one of these tests:
- It affects WordPress core, PHP or the server stack that most WordPress sites run on.
- It affects a plugin or theme with a large install base.
- It is being actively exploited in the wild.
- It needs action from site owners, not just from developers.
Every entry links to the original source: the WordPress.org news blog, the PHP project, the plugin developer’s changelog or a recognised security research team. If we are not sure about a detail, we say so instead of guessing.
Signs your site may already be affected
Security news is most useful before an attack, but it is worth knowing the warning signs:
- Visitors are redirected to spam, gambling or fake prize pages, especially on mobile.
- Google Search Console reports “Security issues” or “Hacked content”.
- New admin users appear that you did not create.
- Unknown files show up in /wp-content/uploads/ or the site root, often PHP files with random names.
- Your host suspends the account for malware or sending spam.
If you see any of these, follow our guide to a WordPress site hacked and redirecting to spam. If you would rather hand it off, compare options in our WordPress malware removal service guide.
A weekly 10-minute security routine
You do not need to read every advisory. A short routine covers most risk:
- Monday: open Dashboard → Updates and apply core, plugin and theme updates after a quick backup.
- Check backups: confirm last night’s backup finished and is stored off the server. See our WordPress backup guide.
- Scan this page: check whether anything listed here affects a plugin you run.
- Review users: remove accounts that no longer need access.
- Glance at Search Console: look for security warnings or sudden drops in indexed pages.
Larger sites should test updates on a staging site first, especially major plugin updates for page builders, WooCommerce and membership plugins.
Country notes for UK, Canadian and Australian site owners
Security is not only a technical issue. If a breach exposes personal data, legal duties can apply:
- United Kingdom: under UK GDPR, a personal data breach that is likely to risk people’s rights must be reported to the ICO within 72 hours of becoming aware of it.
- Canada: under PIPEDA, breaches that create a “real risk of significant harm” must be reported to the Privacy Commissioner and affected people, and a record kept of every breach.
- Australia: the Notifiable Data Breaches scheme requires organisations covered by the Privacy Act to notify the OAIC and affected people about eligible data breaches.
- United States: every state has its own breach notification law, and rules depend on where affected customers live.
Keeping WordPress patched is one of the simplest ways to avoid ever needing these processes.
Archive of past entries
- October 2026: WordPress 7.2 Beta 1 on October 20 (final release planned for December 8). PHP2Shell fixes released on October 21. WordPress 7.1.3 maintenance and security release on October 6.
- September 2026: WordPress 7.1.1 maintenance and security release on September 17, followed by 7.1.2 on September 22.
- August 2026: WordPress 7.1 released on August 19. Review plugin compatibility before major updates.
FAQ
How often should I check WordPress security news?
Once a week is enough for most sites, as long as automatic minor core updates are on and you apply plugin updates regularly. Check immediately if your host or a security plugin sends an alert.
Do automatic updates make WordPress secure?
They help a lot, but they are not everything. Automatic minor updates patch core quickly. You still need plugin updates, strong passwords, two-factor authentication, backups and a patched PHP version from your host.
Is WordPress less secure than other platforms?
WordPress core has a dedicated security team and a fast patch process. Most incidents come from outdated plugins, weak passwords and unpatched servers, which you can control. Read our WordPress security guide for the full picture.
Where do official WordPress security announcements appear?
On the WordPress.org news blog under the Security category. Be careful with emails that claim to be from WordPress asking you to install a “security patch” plugin: these are a common phishing trick.
WordPressPrime.com is an independent guide and is not affiliated with the WordPress Foundation, WordPress.org or Automattic. Always back up your website before making changes, and check official sources for the latest details.
