10/22/2026
Two critical PHP security threats emerged this week. Both demand immediate attention.
On October 21, two PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619) received emergency patches. Both carry a CVSS score of 9.2 and can allow unauthenticated remote code ex*****on.
At the same time, stolen UpdraftCentral connection keys are being used to compromise WordPress sites, install malicious plugins, and create hidden administrator accounts.
Raxis responded immediately. On Wednesday, our team assessed every Raxis PTaaS customer's environment for these threats, provided direct communication with environment-specific details, and issued a critical security alert to newsletter subscribers.
In our latest news blog, Raxis' Jason Taylor breaks down both threats, which systems may be affected, and the steps organizations should take now.
Don't wait to determine whether your PHP servers or WordPress sites are exposed.
Read the full blog: https://raxis.com/blog/php2shell-and-updraftcentral-keys-two-php-threats-to-fix-now/