Two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) can allow unauthenticated attackers to execute code on affected web servers. Both carry a CVSS v4.0 score of 9.2, and exploitation attempts are already being observed in the wild.

PHP has released the following fixed versions:

PHP branch
Fixed version

PHP 8.5
8.5.12

PHP 8.4
8.4.27

PHP 8.3
8.3.36

PHP 8.2
8.2.35

If you manage your own server or VPS, install the appropriate update immediately.

Continue reading Critical PHP Security Update: Two RCE Flaws (CVE-2026-109618, CVE-2026-109619) at Sucuri Blog.

You load your site, or visit an API endpoint your app relies upon, and instead of a page you find a brief, unhelpful message: 401 Unauthorized. Sometimes a browser password box appears. Other times, a blank white page presents only that number. In either case, visitors are shut out, and if the error strikes your admin area, even you are left at the threshold.

The good news is that a 401 is one of the more honest HTTP responses.

Continue reading HTTP 401 Unauthorized: What It Means and How to Fix It at Sucuri Blog.

You load your own site, and instead of your homepage you get a blank page with a line of text reading 500 Internal Server Error. No explanation, no stack trace, nothing to act on. For visitors, it looks like the site is simply gone, and for you it usually means the admin area is down too, so the one tool you’d normally reach for is unavailable.

The frustrating part is that a 500 is deliberately vague.

Continue reading 500 Internal Server Error: What It Means and How to Fix It at Sucuri Blog.

If you run a website, you’ve already met encryption even if you’ve never used the word. It’s the 🔒 padlock in the browser bar, the reason your host told you to stop using plain FTP, and the checkbox on your backup settings that says “encrypt archive.”

Encryption is one of the few security controls that works quietly and almost never needs your attention, which is exactly why it’s easy to misunderstand. Plenty of site owners install an SSL certificate, see the padlock appear, and assume the site is now “secure.” That’s the gap we want to close here.

Continue reading What Is Encryption? How It Protects Your Website and Its Data at Sucuri Blog.

If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation following an attack. Most security breaches we observe originate from automated attacks that exploit known software vulnerabilities, often the same ones that have been previously reported and disclosed.

To assist in maintaining your security posture, we have compiled this month’s summary of essential security updates and vulnerability patches pertinent to the WordPress ecosystem.

Continue reading Vulnerability & Patch Roundup — September 2026 at Sucuri Blog.

Overview

During recent website cleanup work, we analyzed a WordPress compromise where the same backdoor kept returning within seconds of every removal, no matter how carefully the visible files were deleted. Throughout this article, we’ll refer to this family of malware as SC, named after the “SC_” markers found in the injected content.

What makes SC worth documenting is how it survives. The payload lives in at least eight places at once, spread across files, the database, and shared memory, and every one of those places can rebuild all the others.

Continue reading SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor at Sucuri Blog.

In short, WordPress security plugins are tools you add to your site to strengthen your settings, scan for malware, watch for file changes, and block suspicious activity from within WordPress. Most sites should use one, along with a firewall that filters traffic before WordPress even loads. Look for layered protection, good detection, clear handling of false alarms, minimal impact on performance, and real human support.

If you manage a WordPress site, you have probably searched for “best WordPress security plugin” at some point.

Continue reading WordPress Security Plugins: How to Choose the Right One at Sucuri Blog.

If you operate a website, you’re already aware that a single unpatched vulnerability can render your site inaccessible, compromise your reputation, or necessitate extensive remediation following an attack. Most security breaches we observe originate from automated attacks that exploit known software vulnerabilities, often the same ones that have been previously reported and disclosed.

To assist in maintaining your security posture, we have compiled this month’s summary of essential security updates and vulnerability patches pertinent to the WordPress ecosystem.

Continue reading Vulnerability & Patch Roundup — August 2026 at Sucuri Blog.

Third-party scripts are common on websites. They help with analytics, ads, live chat, social media, video, payments, and many other features. While not all are risky, every external tag, pixel, widget, or embed adds to your website’s vulnerability. These tools can read page content, collect visitor data, change what users see, and connect with outside services. If a vendor, account, or setup is compromised, it can impact every page that uses the script.

Website owners shouldn’t aim to get rid of useful integrations, but to understand which scripts run, why they are necessary, who controls them, and how to detect unexpected changes.

Continue reading Third-Party Script Security: How Tags, Pixels, and Embeds Can Put Websites at Risk at Sucuri Blog.

Each feature that you add to a website results in a new element that has to be managed.

The credentials are accepted by a login page, the data by a contact form, new code is introduced by a plugin, and an API is used to connect your website to another service. It is also possible that an old staging site or a forgotten backup may still be accessible from the internet.

The collection of these exposed components constitutes your website attack surface.

Continue reading What Is a Website Attack Surface? A Beginner’s Guide to Reducing Risk at Sucuri Blog.

2026: the year the tools learned to hack

In May 2026, OpenAI began testing an internal research model against a cybersecurity benchmark called ExploitGym. While the test environment was not supposed to have access to the open internet, there was, however, one narrow path out because the agents still needed a way to install software: an internally hosted Artifactory server that acted as a cache for package downloads. That pathway turned out to be enough for the model’s agents to eventually circumvent the test’s rules and escape confinement.

Continue reading The Illusion of a Lock – How AI is changing the speed and scale of hands-on WordPress vulnerability research. at Sucuri Blog.