WordPress News Roundup October 2026: WordPress 7.1.4 Release, WordPress 7.2 Beta, PHP2Shell and the UpdraftCentral Key Breach

October 2026 was a month of security emergencies stacked on top of each other. The PHP project shipped urgent fixes for two critical remote code execution flaws, a breach at TeamUpdraft let an attacker use stolen UpdraftCentral keys to plant backdoors on WordPress sites, and WordPress 7.1.4 closed an upgrade-window RCE that attackers started probing almost immediately.

Meanwhile, WordPress 7.2 reached feature freeze with Beta 1 on October 20, and Automattic began a new round of layoffs in the wake of September’s failed attempt to sideline Matt Mullenweg.

Mergers, Acquisitions, and Investments

No significant WordPress acquisitions closed in October. The corporate news was about contraction rather than expansion.

• Automattic layoffs: TechCrunch reported on October 21 that Automattic had begun layoffs affecting communications, social media, WordPress.com marketing and product, and the WordPress VIP enterprise business, with insiders expecting further cuts over several months. Mullenweg said the number of terminations was not above normal levels, and a spokesperson said the changes were being staggered to allow more generous severance.
• Leadership departures: Interim CFO Jeremy Klaperman left in early October, less than a month into the role, following the September exits of the CFO and chief legal officer. Fortune published a detailed account of the 33-hour board episode on October 19.

WordPress Core Updates

• WordPress 7.1.3 (October 6): A maintenance and security release with seven security fixes and four bug fixes, led by Jake Spurlock. Three of the issues, including a second-order SQL injection in WXR export, were reported by Anthropic, and another by Trail of Bits working with OpenAI.
• WordPress 7.2 Beta 1 (October 20): The first beta marked feature freeze. It includes text shadow support, a “Customized” filter and inherited Global Styles in the inspector, emoji reactions and a minimised mode for Notes, an “On This Day” dashboard widget, updated admin icons, a DataForm-based block inspector and a new Secrets API for storing credentials. Beta 2 followed on October 27.
• WordPress 7.1.4 (October 28): A security release led by Aaron Jorbin and Nik Tsekouras. It fixes a weakness in the upgrade process that could allow remote code execution during the upgrade window, several stored XSS issues in blocks and the Interactivity API, discoverable Customizer changesets and Notes visible to users without edit access, and updates bundled root certificates after the eMudhra revocation. Beta 3 of 7.2, released the same day, carries the fixes.
• Release schedule: WordPress 7.2, led by Mullenweg, is scheduled for December 8, with Release Candidate 1 on November 17. It will ship the new minimal Ipsum default theme.

Other WordPress News

• PHP emergency release: On October 21, John Blackbourn urged site owners to update PHP immediately after the PHP project fixed two critical vulnerabilities. No WordPress update was needed because the flaws sit in PHP itself, and the post reminded readers that versions before 8.2 no longer receive security updates.
• Legal update: At an October 7 hearing on WP Engine’s request for sanctions over the preservation of Mullenweg’s messages, the magistrate judge said he was leaning toward denying the request. The September ruling that revived WP Engine’s antitrust claims means the case continues on both sides.
• Kraków course begins: Kraków University of Technology’s WordPress course, announced at WordCamp Europe in June, was scheduled to start this month with its first cohort.

Security Alerts and Plugin Vulnerabilities

• PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Both flaws, rated 9.2 under CVSS v4.0, allowed unauthenticated code execution on servers running PHP. They were fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosts including GoDaddy, WP Engine and Kinsta rolled out fixes at the platform level within days.
• UpdraftCentral key breach: Attackers breached TeamUpdraft over the weekend of October 17–18 and obtained UpdraftCentral connection keys, which they used to install backdoor plugins on connected sites. Patchstack, which tracked 99 different backdoor plugin names, stressed that this was key theft rather than a code flaw in UpdraftPlus. Site owners should delete existing UpdraftCentral keys and update to 1.26.13 (free) or 2.26.13 (premium), which removes old keys.
• Bricksforge exploited: An unauthenticated arbitrary file upload in Bricksforge (CVE-2026-85097, CVSS 10.0) was exploited from October 7. Versions up to 3.1.8.9 are affected, and 3.1.8.10 fixes it.
• Upgrade-window RCE: Wordfence logged more than 18,500 exploit requests targeting the 7.1.4 upgrade-window flaw (CVE-2026-119977) in the first 21 hours after release, and by early November CISA had added it to its Known Exploited Vulnerabilities catalogue.
• Brotli flaw: CISA also added CVE-2026-111497, a critical bug in the Brotli compression library dubbed HTTP2Shell, to its catalogue on October 27. It is not a WordPress bug, but researchers demonstrated a path to WordPress sites through XML-RPC pingbacks, so server owners should update Brotli.

Industry Trends and Insights

• Market share near 40%: W3Techs put WordPress at 40.2% of all websites on October 1, and 58.7% of sites with a known CMS, down from 43% at the start of the year.
• AI labs as security researchers: 7.1.3 credited Anthropic and a Trail of Bits and OpenAI collaboration, following an Anthropic credit in August’s 7.0.3. AI-assisted auditing is now finding real bugs in mature open source code at a steady pace.
• The stack is the attack surface: October’s worst issues came from PHP, a compression library and a vendor’s customer database, not WordPress core. Keeping sites safe now depends as much on hosts and vendors as on clicking “Update.”
• Remote management carries risk: The UpdraftCentral breach showed how dashboard keys that never expire can turn a vendor breach into site compromise, a lesson for every remote management tool.

Theme of the Month: Kadence

Kadence remains one of the most popular lightweight themes for agency builds, pairing a fast theme with its own block library and starter templates. As 7.2’s betas brought text shadows, inherited Global Styles in the inspector and Notes improvements, flexible themes like Kadence were where many builders tested the new controls on real client designs.

Plugin of the Month: Static Site Importer

Static Site Importer, built by Automattic engineer Chris Huber and available on GitHub, converts static HTML, CSS and JavaScript sites into WordPress block themes, mapping markup to core blocks. Featured on the WP Tavern podcast on October 21, it works best on small brochure sites today and shows how much easier migrating to WordPress is becoming.

Host of the Month: GoDaddy

GoDaddy said it had patched every PHP version on its Web Hosting platform by October 22, the day after the PHP2Shell fixes were released, with no action needed from customers. It also explained that patched builds might not show a new version number, a helpful detail for site owners checking Site Health.

Founder of the Month: Remkus de Vries

Remkus de Vries, co-founder of the site monitoring service Scanfully, discussed Scanfully 2.0 on the WP Tavern podcast on October 28. The release adds plain-language dashboards, grouped alerts, a public API and a read-only MCP server, timely tools in a month when site owners needed clear warnings about vulnerable plugins and unexpected changes.

Looking Ahead to November 2026

WordPress 7.2 Beta 4 and Beta 5 are scheduled for November 3 and 10, with Release Candidate 1, the hard string freeze and the Field Guide due on November 17 ahead of the December 8 release. The call for speakers for WordCamp Asia 2027 in Penang closes on November 8. Deal-making has already picked up: in early November, the Awesome Motive-backed WPBeginner Growth Fund announced it had acquired Drip and Sleeknote. Expect more fallout from the UpdraftCentral breach and continued attacks on unpatched 7.1 sites.