AEU Hosting Blog
News and analysis from our engineers.
WordPress vulnerabilities include critical core RCE chain
Wordfence logged 1,077 WordPress vulnerability reports in July 2026, including a critical core code-execution chain and a plugin backdoor.
PHP2Shell rollout patched vast hosting infrastructure
PHP2Shell fixes reached hundreds of thousands of hosting containers after emergency defenses blocked over 550,000 exploit requests.
WordPress 7.1.4 fixes core RCE amid active attack probes
WordPress 7.1.4 closes a high-severity core update flaw as attackers repeatedly probe sites for the brief window needed to execute code.
WordPress vulnerabilities leave 43 flaws unpatched
WordPress vulnerabilities affected 182 plugins and 15 themes in one week, with 43 flaws still unpatched and seven rated critical.
WordPress operations decide whether AI actually saves time
WordPress operations, documentation and diagnostics determine whether AI speeds agency work or merely creates a larger review queue.
PHP2Shell attacks continue with no confirmed WordPress cases
PHP2Shell scanning is active, but no WordPress compromise was confirmed by October 28. Site owners still need patched PHP and a restart.
WordPress 7.1.4 fixes 22 flaws, including update RCE
WordPress 7.1.4 fixes 22 vulnerabilities, including a brief unauthenticated remote-code-execution risk during software updates.
AI WordPress development requires more review and support
AI WordPress development can shorten coding time, but testing, release planning, monitoring and long-term maintenance still require human work.
PHP2Shell patches address critical WordPress server risk
PHP2Shell flaws could let unauthenticated attackers run code on affected servers; emergency fixes reached Kinsta’s live and staging sites.
497 WordPress vulnerabilities hit plugins and themes
497 WordPress vulnerabilities affected 327 plugins and 23 themes, including 23 critical flaws and 69 issues without patches.
PHP2Shell attacks exceed 74,000 blocks as fixes stay urgent
PHP2Shell attacks have triggered over 74,000 blocks, with no confirmed compromise yet, but vulnerable servers still require urgent PHP updates.
PHP vulnerability fixes close two critical RCE flaws
PHP fixes two critical flaws enabling remote code execution across web setups after attacks and probing were reported around disclosure.
A WordPress AI workload used 27 seconds of PHP time
A WordPress AI image workflow consumed 27.36 cumulative seconds of PHP time in Kinsta's test, showing how concurrent jobs can delay visitors.
Critical PHP vulnerabilities put WordPress sites at risk
Two PHP flaws can let unauthenticated attackers run code behind WordPress sites, making a PHP update and service restart urgent.
PHP security updates close two critical RCE flaws
PHP security updates patch two critical flaws that can let unauthenticated attackers run code on web servers, including those hosting WordPress.
PHP security update fixes two actively targeted RCE flaws
A PHP security update fixes two critical flaws targeted in the wild; website owners must patch the server runtime, not only WordPress.
PHP security update set to fix two critical 9.2 flaws
A PHP security update will fix two critical flaws on October 21. WordPress owners must confirm who will update the server software.
Duplicator vulnerability puts WordPress migrations at risk
A high-severity Duplicator flaw can turn a stored WordPress comment into command execution or file deletion during a later site migration.
655 WordPress vulnerabilities include 21 critical flaws
WordPress sites face 655 newly recorded vulnerabilities, including 21 critical flaws and 289 issues still listed as unpatched.
HTTP 401 Error Means Website Authentication Has Failed
An HTTP 401 error blocks access when credentials fail, but the cause may be a stale session, server rule, proxy, plugin conflict or compromise.
Delete UpdraftCentral keys after WordPress site takeovers
Stolen UpdraftCentral credentials let an attacker install WordPress backdoors remotely, with every version affected and no plugin fix available.
AI-generated WordPress code makes human review essential
AI-generated WordPress code can speed development, but human review remains critical for security, functionality and production readiness.
UpdraftCentral keys enabled WordPress malware installs
Exposed UpdraftCentral credentials let attackers install malicious plugins on connected WordPress sites, including sites running recent UpdraftPlus versions.
Rank Math SEO PRO malware requires full site recovery
Affected Rank Math SEO PRO 3.0.123 packages could leave persistent access, requiring site recovery, credential resets and version 3.0.124.
Backuply WordPress plugin flaw enables site takeover
Backuply versions through 1.5.8 allow subscriber-level attackers to plant SQL that can create an administrator account after a backup restore.
500 Internal Server Error: Start With the Error Log
A 500 Internal Server Error signals a server-side failure. Logs can identify whether code, configuration, resources or malware caused it.
WordPress Content Governance Needs Staging and Backups
WordPress content governance needs staging, restricted access, backups, cache clearing and activity logs as AI increases publishing volume.
Website speed issues drove 70.4% to abandon purchases
Website speed or glitches led 70.4% of surveyed US consumers to abandon purchases, while 31.7% said they would not return after a crash.
WordPress API integrations now shape site reliability
WordPress API integrations can slow checkout, forms and AI features when outside services lag, so sites need monitoring and failure plans.
Ghostscript vulnerability puts PDF uploads at risk
Ghostscript flaw CVE-2026-39919 can expose sites that turn uploaded PDFs into previews; the fix is in version 10.08.0.
WordPress CVE-2026-87902 attacks reach code execution
WordPress CVE-2026-87902 is under active exploitation, with probes progressing to attempts to write PHP files to disk.
WordPress 7.1.2 fixes critical template file flaw
WordPress 7.1.2 patches a critical unauthenticated file inclusion flaw affecting Core versions 4.7.0 through 7.1.1.
WordPress 7.1.1 fixes unauthenticated stored XSS
WordPress 7.1.1 patches a stored XSS flaw in comments, plus ten other security issues affecting Core and older branches.
WordPress bots need a measured response, not a blanket ban
WordPress bots can slow sites, waste resources or help search visibility, so owners need a plan to allow, challenge or block traffic.
AI agent guardrails for safer WordPress updates
AI agent guardrails can stop automated WordPress work from reaching production without staging, backups, limited access and human review.
Public key cryptography faces questions over AI progress
Public key cryptography underpins secure web payments; Wordfence warns AI mathematics could challenge it, but reports no demonstrated encryption break.
WordPress upload flaw lets attackers plant executable files
WordPress sites using vulnerable Bricksforge versions face active attacks that can run malicious code without a login; version 3.1.8.10 fixes the flaw.
WordPress: 52 of 501 disclosed flaws remain unpatched
WordPress disclosures covered 501 flaws in plugins and themes, Wordfence reports, with 52 unpatched and 20 rated critical, making update checks essential.
WordPress fixes theme-install flaw that enabled takeover
WordPress 7.1.1 fixes Click2Shell, an attack chain that could turn an administrator's interaction with a malicious link into server-side code execution.
Unmanaged Third-Party Scripts: A Security Blind Spot
Third-party tags, pixels and embeds can read page data, change what visitors see, and enable payment card skimming if compromised, requiring tighter oversight.
WordPress Staging Sites Must Be Secured Too
A staging copy of your WordPress site can expose admin accounts, customer data and API keys. Here is how to lock it down.
Sucuri Account Logins Move to New Authentication Platform Aug 10
Sucuri starts migrating customer logins to sso.sucuri.net on August 10, 2026; passwords and two-factor authentication stay unchanged, and old links redirect aut…
WordPress 7.1.3 Fixes Comment XSS and Private Post Leaks
WordPress 7.1.3 patches seven security flaws, including a private-post comment leak and a stored XSS triggered by a moderator clicking a malicious pending-comme…
WordPress XSS Campaign Installs Hidden Admin Accounts
A stored XSS campaign abuses Ninja Forms and WPC Product Bundles to install a hidden admin account and backdoor in WordPress sites.
Elementor CSRF Flaw Turns a Clicked Link Into an Admin Account
Elementor 4.3.0 and 4.3.1 let one link opened by an admin perform any REST API action, including creating an administrator. Fixed in 4.3.2.
WordPress Vulnerabilities Drop 24% in Q2 as Attacks Surge
Wordfence's Q2 2026 report shows 2,073 WordPress vulnerabilities disclosed, a 24% drop, but high-risk flaws and attack volume jumped sharply.
260 WordPress Plugin Vulnerabilities Found, 38 Unpatched
Wordfence logged 260 vulnerabilities across 207 WordPress plugins last week; most are patched, but 38 remain unpatched and need immediate site owner action.
Wordfence 9 adds free passkeys for WordPress login
Wordfence 9 gives WordPress site owners a free passkey option that replaces passwords with one-click, fingerprint or face sign-in and makes phishing harder.
Self-healing WordPress malware hides in database and RAM
Sucuri documented SC, a WordPress backdoor that rebuilds itself from eight places, including the database and shared memory.
WordPress Security Plugins: Pick the Layers That Matter
Sucuri explains what WordPress security plugins actually do, their limits, and why layering hardening, firewall, scanning, and backups is essential.
AI finds hidden flaws in rarely-updated WordPress plugins
AI is rapidly finding unreported flaws in small WordPress plugins; a researcher's isolated lab turned suspicious code into verified vulnerabilities.
Wordfence: 319 WordPress Plugin Vulnerabilities in a Week
Wordfence recorded 319 vulnerabilities across 222 WordPress plugins in late September; 13 remain unpatched, including a core local file inclusion flaw.
Wordfence June Bug Bounty: 1,066 Reports, $42,553 Paid
Wordfence's June 2026 bug bounty program received 1,066 vulnerability submissions and paid $42,553, including critical flaws in Everest Forms Pro, Burst Statist…
362 WordPress Plugin Vulnerabilities Disclosed Last Week
Wordfence added 362 flaws across 247 plugins and 4 themes, including an unauthenticated stored XSS bug in WordPress core 7.1 and 45 unpatched issues.
WordPress 7.1.2 patches critical path traversal vulnerability
WordPress 7.1.2 and backports fix a critical flaw that lets unauthenticated attackers include a local PHP file, potentially leading to site takeover. Update now…
Stealthy WordPress malware hides admin via must-use plugin
A stealthy WordPress must-use plugin hides a rogue admin account, stores plaintext passwords, self-restores and spreads across shared hosting, Wordfence reports…
Critical libheif Flaw Lets HEIC Images Run Code on Servers
A critical bug in the libheif image library can let crafted HEIC uploads read files or run code on vulnerable WordPress servers.