Notices.

Malware in Rank Math PRO downloads on 16 October

Rank Math found malware in some copies of its PRO plugin, version 3.0.123, that were downloaded or installed as an update between 7:02am and 6:12pm AEDT on Friday 16 October 2026. It has released a clean 3.0.124 and says any site that activated an affected copy should be treated as compromised. The free Rank Math SEO plugin from WordPress.org was not affected.

Two critical vulnerabilities in PHP itself

PHP, the language WordPress, WooCommerce, Magento and most content management systems run on, has two critical flaws, both rated 9.2 out of 10. The fixes are due at 1:00am AEDT on Thursday 22 October 2026, and the ASD says every version from PHP 5 onwards may be affected. If your website runs on PHP, make sure whoever manages its server is ready to update the moment the release lands.

Update, 22 October 2026. The PHP team has released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix both flaws. We have implemented patching across all of our servers. If your website is hosted somewhere else, ask your host to confirm the update has been applied.

Stolen UpdraftCentral keys used to backdoor WordPress sites

Over the weekend of 17 and 18 October 2026, an attacker got into TeamUpdraft, the company behind the UpdraftPlus backup plugin, and took the keys that let its UpdraftCentral service manage WordPress sites remotely. They used those keys to install backdoor plugins on connected sites. If a site you run uses UpdraftPlus, update it to 1.26.13 or 2.26.13, delete its UpdraftCentral keys and check it for the signs below.

Adobe Commerce and Magento stores under active attack

CVE-2026-75650 scores a full 10.0 and lets an attacker run code on an Adobe Commerce or Magento Open Source store without logging in. It was exploited before a patch existed, Adobe has since shipped one, and the ASD says a substantial number of potentially vulnerable instances are in Australia. If you run one of these stores, patch it today.

Rank Math created admin-level site credentials without a clear ask

Rank Math version 1.0.277 shipped a Support Agent that created a WordPress Application Password when an administrator opened the plugin's Help and Support panel. The credential carried that user's permissions and did not expire. Rank Math paused the feature five days later and accepted that it had not asked clearly enough. No misuse has been reported, but any credential created in that window is still live until somebody revokes it by hand.

Twelve vulnerabilities exposed across WordPress 4.7 to 7.0.2

WordPress released 7.0.3 on 6 August 2026, fixing twelve separate vulnerabilities. The most serious, CVE-2026-64638, is a pre-authentication flaw on the login screen rated 8.9 out of 10, and it affects every version of WordPress released since 2016. Update to 7.0.3, 6.9.6 or 6.8.7. This arrives three weeks after the WP2Shell chain, and that pattern matters more than any single item on the list.

WP2Shell: critical WordPress core vulnerability chain

WP2Shell chains two flaws in WordPress core to give an anonymous attacker full remote code execution on a stock install, with no plugins, no configuration quirks and no login required. It is being exploited in the wild. If you run WordPress, confirm you are on 6.9.5, 7.0.2 or 6.8.6 or later today, and check your site for the signs of compromise listed below.

Large-scale exploitation campaign targeting CMS-based websites

A coordinated campaign is exploiting known vulnerabilities in popular CMS platforms to compromise websites at scale. Owners and administrators of WordPress and other CMS-based sites should ensure all core software, plugins and themes are kept up to date, that administrator accounts use strong unique passwords with MFA enabled, and server-level protections such as WAF and file-integrity monitoring are in place.