Category: Security
-
CVE-2026-109618 & CVE-2026-109619: Critical PHP RCE and How to Patch
On 21 October 2026 the PHP project published two critical vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619. Both…
-
CVE-2026-18143: Request a Quote for WooCommerce — Update to 2.9.3
A critical unauthenticated file upload flaw in Request a Quote for WooCommerce is fixed in version 2.9.3. Here’s…
-
CVE-2026-63030: WordPress Core RCE Chain — Confirm You’re Patched
A chained core vulnerability nicknamed wp2shell allows unauthenticated remote code execution. Fixed in 6.8.6, 6.9.5, and 7.0.2 —…
-
CVE-2026-85097: Bricksforge RCE — Update to 3.1.8.10 Now
Bricksforge versions up to 3.1.8.9 allow unauthenticated remote code execution via a file upload flaw. Exploitation is already…
-
CVE-2026-104398: WooCommerce AFFI Plugin Object Injection — Update Now
An unauthenticated PHP object injection flaw in AFFI for WooCommerce opens a direct path to remote code execution.…
-
WordPress Database Table Prefix: Does Changing wp_ Actually Help?
Automated attacks assume wp_ as the table prefix. Changing it blocks that narrow assumption — but breaks any…
-
WordPress File Upload Security: Why Blocklists Fail and Allowlists Win
A blocklist misses .phtml, .php5, .php7, .pht, and .phar — extensions some server configs still execute as PHP.…
-
The WordPress XSS Campaign That Hides Its Own Admin Account
Two unrelated plugin XSS flaws deliver the same payload: a hidden admin account, a backdated backdoor, and files…
-
WordPress Malware Detection: Signature-Based vs Behavioral Scanning
AI-generated obfuscation now bypasses traditional signature scanners — behavioral analysis and file integrity monitoring catch what signatures miss.
Ready to start your project?
Share your brief and we’ll propose the right approach — a full site, a landing page, or a custom plugin.