Three security items from the past two weeks matter if you run WordPress or Drupal. Everything below is as reported on October 21, 2026, so please confirm the details on the official pages before you act.
PHP: two critical flaws, now patched
PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Reports say a single unauthenticated request can trigger them, and any PHP setup that serves web requests is affected. At the time of writing, no confirmed attacks in the wild have been reported.
What to do: update PHP, or install the patched package from your host or Linux distribution. If you are still on PHP 8.1 or older, ask your host about a backport or move to a supported version.
WordPress: Bricksforge plugin, CVE-2026-85097
This add-on for the Bricks builder has a CVSS 10.0 flaw in its form file upload handling that lets an unauthenticated attacker run code. Versions up to 3.1.8.9 are affected, and Patchstack reported attacks from October 7. Sources differ on the exact fixed version number, so update to the newest release in your dashboard. After updating, look for unexpected PHP files in the plugin's tmp folder under wp-content/uploads and review your form submission logs.
Drupal: Field UI remote code execution, CVE-2026-108097
Published on October 14 as SA-CORE-2026-014 and rated critical. Core alone is not directly exploitable, but contributed modules or custom code can expose it. Update to Drupal 11.4.10, 11.3.19 or 10.6.19. If you cannot update right away, uninstall the Field UI module after checking dependencies. A related contributed module issue, Entity List (SA-CONTRIB-2026-218), is fixed in version 3.0.10. Drupal 8, 9, 10.5 and earlier, and 11.2 and earlier no longer get security fixes, so those sites need to move to a supported branch.
A simple protection routine
Take a backup first, test updates on staging, update PHP and plugins or modules before anything else, then core, and check key pages and forms afterwards. Remove plugins and modules you do not use, give admin access only to people who need it, keep a web application firewall in front of the site, and watch for new or changed files after every incident like this.
Which of these are you patching first? I would love to hear how your updates go.
Also on Medium. More WordPress and web security notes at expertwebdeveloper.in
Top comments (0)