In the same week of October 2026, two unrelated incidents opened a path into ordinary business websites. One is a critical, unauthenticated bug in PHP itself. The other is a credential breach at the company behind UpdraftPlus, one of WordPress's most widely installed backup plugins. Neither requires the site owner to have done anything wrong, and neither is the kind of thing that shows up until it does. Both are worth ten minutes today.
Two separate incidents, both from October 2026. PHP's own maintainers shipped emergency patches on 20 October for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, rated 9.2 to 9.8 in severity. If your site, or anything else on the same server, runs an unpatched PHP version, it is exposed regardless of which CMS you use. Separately, TeamUpdraft, the company behind UpdraftPlus, had its own systems breached over the weekend of 17 to 18 October, exposing stolen keys that let attackers remotely install a backdoor plugin on WordPress sites with UpdraftCentral connected. The UpdraftPlus plugin itself was not tampered with. Check your PHP version against the patched releases below, and if UpdraftCentral has ever been connected to your site, revoke that connection whether or not you have updated.
What actually happened
Both stories broke in the same seven days, which is coincidence rather than a connected attack, but the overlap is why this is worth one combined check rather than two separate ones.
| Date | What happened | Why it matters to you |
|---|---|---|
| 17 to 18 October 2026 | TeamUpdraft's own website was compromised. The company says attackers accessed a customer database containing connection keys for UpdraftCentral, its remote WordPress management service | The exposure is the keys, not the plugin you installed. Updating UpdraftPlus alone does not close it |
| Days following | Security researchers at Patchstack found attackers using the stolen keys to remotely issue a command that installs and activates a backdoor plugin on connected WordPress sites | If UpdraftCentral was ever connected on your site, even years ago, assume it was a target |
| 20 October 2026 | The PHP project released emergency patches for two critical remote code execution flaws after exploit details leaked ahead of the planned disclosure date | This is in PHP itself, not a plugin, so any PHP-based site is in scope regardless of CMS |
| 21 October 2026 | CISA and the UK's National Cyber Security Centre both issued guidance urging immediate patching, and researchers at watchTowr reported active exploitation attempts against both flaws | This moved from disclosed to actively targeted within a day |
Which one applies to you?
Run through these two questions before anything else. Most self-managed WordPress sites need to check both.
| Question | If yes |
|---|---|
| Has UpdraftCentral ever been connected to your site, even once, even years ago? | Work through the UpdraftPlus checklist below, regardless of your current plugin version |
| Does your site, or anything else on the same server, run PHP, under WordPress, Drupal, Joomla, Magento or custom code? | Work through the PHP2Shell checklist below |
A site on a fully managed platform such as Shopify, Squarespace or Wix is not directly exposed to either issue, because the platform controls that layer for you. It is still worth a one-line email to your provider confirming it, rather than assuming.
Incident 1: the PHP core bug, PHP2Shell
CVE-2026-109618 and CVE-2026-109619 are both unauthenticated remote code execution flaws in PHP itself. One stems from how PHP exits a request context when it runs out of memory, which can interrupt execution while request data is only partially initialised. The other involves PHP keeping a reference to request data after its backing memory has already been freed. Both can be exploited by an attacker who never needs a password or an account on your site.
| PHP version line | Vulnerable | Patched |
|---|---|---|
| 8.5 | Below 8.5.12 | 8.5.12 |
| 8.4 | Below 8.4.27 | 8.4.27 |
| 8.3 | Below 8.3.36 | 8.3.36 |
| 8.2 | Below 8.2.35 | 8.2.35 |
PHP versions older than 8.2 were already past end of life before this disclosure and were not patched. If your host is still running one of those, the real fix is upgrading PHP itself, not waiting for a point release that will not come.
- Find your PHP version. Your hosting control panel usually shows it directly, or ask your host or developer.
- Compare it against the table above.
- If you manage your own server, update and restart. The patch only takes effect once Apache, PHP-FPM and any long-running PHP workers are restarted, not just installed.
- If you are on shared or managed hosting, confirm with your host directly. Most reputable hosts patch the infrastructure layer automatically, but confirming beats assuming when the severity is this high.
- If you cannot update immediately, disable
session.upload_progress.enabledas an interim step. This mitigates one of the two flaws only and is not a substitute for patching.
Incident 2: the UpdraftPlus and UpdraftCentral breach
TeamUpdraft says its own website, not the plugin's code or its official downloads, was compromised, and that attackers obtained a database of customer connection keys for UpdraftCentral, a separate service that lets one dashboard manage backups across many WordPress sites. According to Patchstack's research, attackers used those stolen keys to remotely call a command that installs and activates an uploaded plugin on the connected site. The planted plugin then waits for a secret URL parameter before creating a new administrator account, commonly using an email address on the example.org domain and the display name "Site Tools."
TeamUpdraft has released UpdraftPlus 1.26.13 for free users and 2.26.13 for Premium users, which revokes older UpdraftCentral Cloud connections. Updating alone is not the full fix: it does not clean a site that has already been backdoored, and it does not guarantee every exposed key has been closed.
- Check whether UpdraftCentral has ever been connected. Look under UpdraftPlus settings, or ask whoever manages the site.
- If it has, revoke that connection now, regardless of whether you have updated the plugin.
- Update UpdraftPlus to 1.26.13 or 2.26.13.
- Check your WordPress admin users list for an account you did not create, especially one with an example.org email address or the display name "Site Tools." Remove it and treat the site as compromised rather than assuming deletion alone fixes it.
- If you run Wordfence or Patchstack, confirm their emergency firewall rules are active. Both released rules blocking the malicious UpdraftCentral commands within days of the breach becoming public.
We run this exact two-part check on every WordPress and PHP site we maintain the week a disclosure like this lands: PHP version first, because it takes thirty seconds to confirm and the blast radius is server-wide, then a pass through every plugin with a remote-management connection, not just UpdraftPlus. The second part is the one most site owners skip, and it is the one this particular breach shows the cost of skipping.
The broader lesson: it is not a WordPress problem, it is a remote-connection problem
The detail worth sitting with is that updating UpdraftPlus was never going to fix this on its own, because the plugin was not the thing that broke. The vendor's own systems were. That is a different failure mode than the one most security checklists are written for, and it applies to any plugin or tool that can act on your site from outside the WordPress login screen: backups, staging and migration tools, SEO plugins with an API connection, form builders with a cloud dashboard.
Three questions are worth asking about each one, the next time you or your developer does a plugin audit:
- Can this tool change my site from outside the admin login, through an API key, a cloud account or a remote dashboard?
- If that vendor's systems were breached tomorrow, what could the stolen key actually do, read my data, or install software?
- Do I still actively use that connection, or was it switched on once, years ago, and forgotten?
Reports on this specific breach note that many of the exposed UpdraftCentral keys were created years earlier and had not been actively used recently. A connection nobody remembers is still a connection an attacker can use. Closing the ones you do not need is the kind of maintenance that produces no ticket until the week it does, and it is exactly the kind of audit a website development company runs as ongoing hygiene rather than as a one-off reaction to this week's headline.
Frequently asked questions
What is PHP2Shell?
PHP2Shell is the name security researchers gave to two critical, unauthenticated remote code execution flaws in PHP core, tracked as CVE-2026-109618 and CVE-2026-109619. The PHP project shipped emergency patches on 20 October 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, after exploit details leaked ahead of the planned coordinated disclosure. The PHP project rates both flaws 9.2 on CVSS v4.0, and NVD later scored them 9.8 on CVSS v3.1, both in the critical range.
Is my website affected by PHP2Shell?
If your site, or anything else on the same server, runs PHP, it is affected unless that PHP version has already been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. This includes WordPress, Drupal, Joomla, Magento and any custom PHP application, regardless of which one you actually use, because the flaw is in PHP itself rather than in any of those platforms. Ask your host which PHP version is running, or check it yourself if you manage your own server.
What happened with the UpdraftPlus plugin?
TeamUpdraft, the company behind the UpdraftPlus WordPress backup plugin, said its own website was compromised over the weekend of 17 to 18 October 2026, and that attackers accessed a customer database containing connection keys for UpdraftCentral, its remote site-management service. Security researchers at Patchstack found attackers using those stolen keys to remotely install a backdoor plugin on connected WordPress sites. The UpdraftPlus plugin itself and its official downloads were not tampered with. The exposure is the stolen keys, not the plugin code.
Is updating UpdraftPlus enough to fix this?
No. TeamUpdraft released UpdraftPlus 1.26.13 for free users and 2.26.13 for Premium users, and updating revokes some older UpdraftCentral Cloud connections, but it does not clean a site that has already been backdoored and does not guarantee every exposed key has been closed. If UpdraftCentral has ever been connected to your site, revoke that connection directly, check your admin user list for an account you do not recognise, and update the plugin, in that order.
How do I know if my site was backdoored through the UpdraftPlus breach?
Check your WordPress admin users list for an account you did not create, especially one using an email address on the example.org domain with the display name Site Tools, which researchers identified as the signature left by the malicious plugin. If you find one, remove it and treat the site as compromised rather than assuming deleting the account alone fixes it. Sites that have never connected UpdraftCentral are not exposed to this particular attack path.
Do I need to worry about this if my site is not WordPress?
The UpdraftPlus and UpdraftCentral breach only affects WordPress sites that use that plugin, so it does not apply if you are on a different platform. PHP2Shell is different: it affects the PHP language runtime itself, so any site built on PHP, under any CMS or custom code, is in scope. A site on a fully managed platform such as Shopify, Squarespace or Wix is not directly exposed to either issue, because the platform controls that layer for you, though it is still worth confirming with your provider.
The takeaway
Neither of these incidents needed you to click a bad link or reuse a weak password. One is a flaw in the language your site runs on. The other is a breach at a vendor you trusted with a remote key. Check your PHP version against the table above, check whether UpdraftCentral has ever touched your site, and check your admin user list for anything you do not recognise. Then do the less glamorous part: list every other plugin with a remote connection and ask whether you still need it. That list is what the next version of this story will be about.
Sources & further reading
- The Hacker News, “PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge” (21 October 2026)
- Help Net Security, “PHP2Shell: Critical PHP vulnerabilities patched, update now!” (21 October 2026)
- UK National Cyber Security Centre, “Critical security issue affecting PHP”
- Search Engine Journal, “UpdraftPlus WordPress Plugin Security Breach Enables Backdoor Attacks”
- CSO Online, “WordPress sites compromised after TeamUpdraft credential exposure”