Notices.

Name: The Tasmanian Web Company
Address: Level 1/21 Best St, Devonport, TAS, 7310, AU
Telephone: +61434455864

Advisories and heads-ups on security, hosting, industry changes and platform updates that affect the websites and tools our clients use. We publish these so you can act on what matters and skip the noise on what doesn't.

Security notice Critical 21 October 2026

Two critical vulnerabilities in PHP itself

PHP, the language WordPress, WooCommerce, Magento and most content management systems run on, has two critical flaws, both rated 9.2 out of 10. The fixes are due at 1:00am AEDT on Thursday 22 October 2026, and the ASD says every version from PHP 5 onwards may be affected. If your website runs on PHP, make sure whoever manages its server is ready to update the moment the release lands.
Security notice Critical 19 October 2026

Stolen UpdraftCentral keys used to backdoor WordPress sites

Over the weekend of 17 and 18 October 2026, an attacker got into TeamUpdraft, the company behind the UpdraftPlus backup plugin, and took the keys that let its UpdraftCentral service manage WordPress sites remotely. They used those keys to install backdoor plugins on connected sites. If a site you run uses UpdraftPlus, update it to 1.26.13 or 2.26.13, delete its UpdraftCentral keys and check it for the signs below.
Security notice Critical 10 September 2026

Adobe Commerce and Magento stores under active attack

CVE-2026-75650 scores a full 10.0 and lets an attacker run code on an Adobe Commerce or Magento Open Source store without logging in. It was exploited before a patch existed, Adobe has since shipped one, and the ASD says a substantial number of potentially vulnerable instances are in Australia. If you run one of these stores, patch it today.
Security notice Medium 2 September 2026

Rank Math created admin-level site credentials without a clear ask

Rank Math version 1.0.277 shipped a Support Agent that created a WordPress Application Password when an administrator opened the plugin's Help and Support panel. The credential carried that user's permissions and did not expire. Rank Math paused the feature five days later and accepted that it had not asked clearly enough. No misuse has been reported, but any credential created in that window is still live until somebody revokes it by hand.
Security notice High 7 August 2026

Twelve vulnerabilities exposed across WordPress 4.7 to 7.0.2

WordPress released 7.0.3 on 6 August 2026, fixing twelve separate vulnerabilities. The most serious, CVE-2026-64638, is a pre-authentication flaw on the login screen rated 8.9 out of 10, and it affects every version of WordPress released since 2016. Update to 7.0.3, 6.9.6 or 6.8.7. This arrives three weeks after the WP2Shell chain, and that pattern matters more than any single item on the list.
Security notice Critical 3 August 2026

WP2Shell: critical WordPress core vulnerability chain

WP2Shell chains two flaws in WordPress core to give an anonymous attacker full remote code execution on a stock install, with no plugins, no configuration quirks and no login required. It is being exploited in the wild. If you run WordPress, confirm you are on 6.9.5, 7.0.2 or 6.8.6 or later today, and check your site for the signs of compromise listed below.
Security notice High 9 July 2026

Large-scale exploitation campaign targeting CMS-based websites

A coordinated campaign is exploiting known vulnerabilities in popular CMS platforms to compromise websites at scale. Owners and administrators of WordPress and other CMS-based sites should ensure all core software, plugins and themes are kept up to date, that administrator accounts use strong unique passwords with MFA enabled, and server-level protections such as WAF and file-integrity monitoring are in place.

Not ready to commit? Have a chat anyway.

Tell us about your business and where you would like it to go. We will talk through the options and agree a clear scope and plan before anything begins.

Request a chat, it's free

Chat with us, it's free

The first conversation costs nothing. If we are not the right studio for the job, we will tell you that.
No lock-in contracts

Our Working Together Agreement leaves you free to make the decisions that are right for you and your business.
A long term partner

We provide your website as a service. Changes are an email away, and you never need to think about servers, software updates or learning a content management system.

Two critical vulnerabilities in PHP itself

Stolen UpdraftCentral keys used to backdoor WordPress sites

Adobe Commerce and Magento stores under active attack

Rank Math created admin-level site credentials without a clear ask

Twelve vulnerabilities exposed across WordPress 4.7 to 7.0.2

WP2Shell: critical WordPress core vulnerability chain

Large-scale exploitation campaign targeting CMS-based websites

Not ready to commit? Have a chat anyway.