From weakness to fix
Everything starts with a vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data.: a weakness that lets an attacker do something the software should not allow. Once it is known, it gets a public CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. ID so everyone refers to the same problem. A CVSSCVSS is a score from 0 to 10 that shows how serious a security weakness is, so you can see at a glance which problems to deal with first. score expresses how severe it is, and the NVDThe NVD is a US government database of known security weaknesses. It adds its own severity scores and extra details to the public records of each weakness. adds its own analysis later. The software maker publishes a security advisoryA security advisory is an official notice from a software maker about a security weakness: what it is, which versions are affected and how to fix it. with the affected and fixed versions, and the fix itself arrives as a security patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem..
Proof, exploitation and the worst cases
An exploitAn exploit is a piece of code or a method that turns a software weakness into a real attack. A proof of concept only shows that the attack works. is code that uses a vulnerability. A proof of concept shows that an attack works, which is not the same as attacks happening. Real-world exploitation is tracked in lists such as CISA KEVCISA KEV is a list kept by the US cybersecurity agency CISA of security weaknesses that attackers are known to have used in real attacks.. The most serious category is remote code executionRemote code execution (RCE) means an attacker can make the computer that hosts your site run their own commands from afar. It is among the most serious flaws., where an attacker can run code on your server over the network. Other common types on PHP sites are SQL injectionSQL injection is an attack where text typed into a form or web address is slipped into the database as a command, letting the attacker read or change data., cross-site scriptingCross-site scripting (XSS) is an attack that sneaks a harmful script into one of your pages, so it runs in your visitors' browsers as if you had placed it. and SSRFSSRF is an attack that tricks your website's server into making requests for the attacker, for example to private systems that are closed to the outside..
A current example is PHP2Shell: two critical PHP vulnerabilities fixed on 21 October 2026. That page lists only confirmed facts, each with source and time.
Making the target smaller
You cannot prevent every new vulnerability, but you can reduce how many apply to you. Every pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop., login and line of server code adds to your attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server.. Keeping PHP on a supported version closes known holes, and help to fix your WordPress website helps when a site is already broken or exposed. For sites that mostly publish content, a WordPress to static site move removes PHP and the database from every page view, so a whole class of server-side problems no longer applies.