WordPress Wild West, No Sheriff in Sight

Another week, another parade of critical WordPress bugs proving that “sanitize” is apparently more of a vibe than a security control — and just to keep things spicy, PHP core itself turned up with an unauthenticated RCE that doesn't care which CMS you run. If your plugin stack looks like a garage sale, congratulations - the attackers are already browsing.

This Week's Hall of Shame: Top CVEs

CVE-2026-109618 — Use-after-free-for-all in PHP core

The Gist: PHP's core engine is sporting two unauthenticated remote code execution flaws — collectively branded PHP2Shell — both rated CVSS 9.2: CVE-2026-109618 (an upload-progress use-after-free that can hand freed worker memory back to the client on the way to RCE) and CVE-2026-109619 (a fatal-error backtrace use-after-free paired with OPcache type confusion). Every known trigger is a single unauthenticated multipart/form-data request parsed before your application code even runs, it affects effectively every PHP build since 5.4 across mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed, and public proof-of-concept exploits plus active exploitation attempts are already being reported.

Why It Should Keep You Up at Night: This isn't a plugin you can quietly deactivate — it's the runtime underneath basically the entire PHP-powered internet, so Magento, WordPress, Drupal, and whatever bespoke CMS your predecessor left you are all sitting in the blast radius. Because the bug fires before your application code ever executes, every “but our code is secure” reassurance is doing precisely nothing here. And since a single request can read live worker memory, attackers may wander off with passwords, session tokens, API keys, and TLS private keys from other users' requests — a generous parting gift stapled to the remote code execution.

Your Playbook:

• Patch the PHP runtime immediately — fixed in 8.5.12, 8.4.27, 8.3.36, and 8.2.35 — then restart Apache, PHP-FPM, and any long-running workers; patching your application does nothing because the flaw lives in the engine. On PHP 8.1 or older with no official fix, pull a vendor or distro backport (or upgrade), and confirm the changelog actually references the CVEs instead of trusting an old-looking version number.
• Until you can patch, apply interim-only mitigations: set session.upload_progress.enabled=0 (plus fatal_error_backtraces=0 on PHP 8.5) for CVE-2026-109619, and lock memory_limit=-1 with tight request-size limits at the proxy or web server for CVE-2026-109618 — neither fully closes the hole.
• Hunt for suspicious multipart/form-data requests followed by memory-limit errors or repeated HTTP 500s, abnormally large PHPSESSID cookies in responses, and unexplained PHP worker restarts.

Sources: Rapid Risk Radar | CVE Organization | The Hacker News | Sansec | BleepingComputer

CVE-2026-96331 — Search plugin, found SQLi

The Gist: wpdreams Ajax Search Pro contains a blind SQL injection flaw affecting versions through 4.29.1, rated CVSS 9.3. It can be exploited remotely without authentication, is actively exploited in the wild, and gives attackers database-level leverage without ever needing an account.

Why It Should Keep You Up at Night: Blind SQLi is like dealing with a burglar who robs you one cupboard at a time and still somehow empties the house. Even without flashy error messages, attackers can slowly extract sensitive data, map your environment, and pivot from “just a plugin” to “why is the incident bridge full?” This one also lands in the recurring WordPress tradition of plugins handling user input like a dare.

Your Playbook:

• Upgrade Ajax Search Pro immediately past version 4.29.1, or take it offline until a patched version is confirmed in your environment.
• Add WAF rules and logging around suspicious search-related requests, especially those showing timing anomalies or crafted query input consistent with blind SQL injection.

Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV

CVE-2026-110372 — Privilege escalation with extra audacity

The Gist: Brainstorm Force's OttoKit suretriggers plugin is vulnerable to incorrect privilege assignment leading to privilege escalation in versions through 1.1.40, with a CVSS score of 9.8. The flaw is remotely exploitable without authentication and is already seeing exploitation in the wild.

Why It Should Keep You Up at Night: Privilege escalation bugs are bad enough; unauthenticated privilege escalation is the kind of thing that makes defenders age in dog years. If an attacker can go from internet rando to elevated access through your automation plugin, you've basically outsourced admin onboarding to the threat actor community. Wonderful for efficiency, terrible for literally everything else.

Your Playbook:

• Update OttoKit/suretriggers immediately beyond 1.1.40, or disable the plugin if no validated fix is available yet.
• Audit recent user role changes, new administrative accounts, and suspicious automation-trigger activity for signs of abuse.

Sources: Rapid Risk Radar | CVE Organization | VulnCheck KEV

Industry Intel: What Else is On Fire This Week

• The Harness Is the Hard Part of Agentic Pentesting — Everyone wants AI pentesting magic until it's time to build the guardrails, at which point the room suddenly gets very interested in the floor. Read more

• Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections — If you're still treating “it went over Tor” as shorthand for “therefore safe,” here's your regularly scheduled reality check. Read more

---

Stay ahead of the threat landscape at Rapid Risk Radar — where CVEs get scored and prioritized so you don't have to panic-Google "is this bad" at 2am. Check out the platform and stop flying blind.