Three developments worth reviewing
These are separate incidents, not a chain of attacks against every site. Together they show how exposure can move across layers: from CMS core and extensions to the PHP runtime below them. The sooner the actual versions are known, the more controlled the response can be.
PHP: emergency security releases — 21 October 2026
PHP disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2/10 under CVSS v4.0. Under affected conditions, remote attackers without credentials could execute code with the privileges of a PHP web worker. These issues affect the PHP runtime, so a fully updated WordPress or Joomla application may still rely on an unpatched server.
Patched PHP releases: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are outside ordinary upstream security support; some operating-system or extended-support vendors may supply backported fixes. Older branches did not universally stop functioning, but they need explicit support and patch verification.
WordPress: serious core flaws — July and September 2026
A July disclosure described a chain of core vulnerabilities, including CVE-2026-63030, that could allow unauthenticated remote code execution in WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Fixes were released in 6.9.5 and 7.0.2. In September, WordPress 7.1.2 addressed a separate path-traversal / local-file-inclusion issue (CVE-2026-87902) that could lead to code execution under specific server and theme conditions. These issues have different affected-version ranges: they must not be treated as one universal WordPress vulnerability.
Joomla / JCE: extension exposure — June–July 2026
The Joomla Content Editor (JCE) extension had a critical access-control flaw, CVE-2026-48907, affecting versions before 2.9.99.5. Security agencies reported active exploitation. On susceptible sites it could permit unauthenticated upload and execution of PHP code and, potentially, persistent backdoors. JCE 2.9.99.5 and later address the core flaw; the vendor also published patch guidance for certain older branches. Updating the Joomla core alone would not fix an outdated JCE extension.
EU cybersecurity rules this autumn: what they actually require
On 11 September 2026, reporting requirements under the EU Cyber Resilience Act began for manufacturers of covered products with digital elements: actively exploited vulnerabilities and severe security incidents must be reported. The CRA's main product-security requirements generally apply from 11 December 2027. This is not a blanket order for every website owner to upgrade WordPress or Joomla by an autumn deadline.
For organisations within the scope of NIS2 and its sector-specific implementing rules, security maintenance, vulnerability handling and timely patch management are important obligations. EU Implementing Regulation 2024/2690, section 6.6, explicitly addresses security patch management for specified digital-service providers. Whether your organisation is covered depends on its role, sector, size and national law. Read the practical EU/CMS update guide
How to act on the published evidence
These incidents are not interchangeable. Each has different affected software and remediation steps; start with the guide matching your installation.
For each issue, a version match is an indication to investigate. It does not confirm successful exploitation on a particular website.
Why timing matters, including AI
An unpatched site does not become vulnerable because a deadline passes. What changes is the gap between public technical knowledge and the owner’s ability to respond calmly.
AI-assisted security research is helping identify significant software flaws, and the same automation can help attackers analyze public patches and advisories. Google Threat Intelligence documented an increase in observed exploited vulnerabilities from an average of 10.5 per month in 2025 to 18 per month during January–August 2026. AI did not cause the PHP, WordPress or JCE flaws, and not every published vulnerability is exploited. These numbers describe an observed trend, not a prediction for any individual website.
For site owners, the practical consequence is straightforward: know which PHP runtime, CMS branch and extensions are actually in use; assess their support status; then prioritize the patches relevant to that installation.
What to check before changing a live website
- Confirm the running versions. Ask your host about PHP, and review WordPress/Joomla core, themes and extensions from the administrator interface or deployment inventory. Public website fingerprints are only clues.
- Check patch availability and compatibility. Verify a current backup, assess legacy dependencies, and apply the relevant vendor fixes using a rollback plan.
- Look for signs of compromise when exposure is plausible. Preserve relevant logs and inspect unexpected administrator accounts, uploads, scheduled tasks and file changes. A patch closes a flaw; it does not automatically remove an existing backdoor.
Sources and verification
Dated references for this briefing. Affected ranges and vendor guidance may change; check the current advisory before acting.
- PHP project — 21 October emergency release and CERT-EU advisory 2026-018
- WordPress July RCE advisory (CVE-2026-63030) and WordPress 7.1.2 security release
- JCE vendor security update and MyCERT alert (CVE-2026-48907)
- Google Threat Intelligence — discovery and exploitation trends in the AI era (30 September 2026)
Unsure about your site's exposure?
You do not need to assume the worst. Start with what can be verified from outside, then confirm PHP and installed components with your host or administrator. That is easier to do before an outage forces rushed decisions.
Start with the free public website check for reputation and detectable software clues, or describe the concern in a free scope enquiry. Neither requires passwords. Any paid technical assessment or repair is agreed separately.