Vulnerability

A vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. A weakness can exist for years without anyone using it, and it stops being a problem the moment the fix is installed.

What is a vulnerability?

An attacker might read data, change a page or run their own code on a server. A vulnerability is a property of the software, not of an attack.

Most vulnerabilities are ordinary mistakes. A developer forgets to check input from a visitor, trusts data that should not be trusted or handles memory in a way that can be pushed off course. Well-known families have their own names, such as SQL injectionSQL injection is an attack where text typed into a form or web address is slipped into the database as a command, letting the attacker read or change data. and cross-site scriptingCross-site scripting (XSS) is an attack that sneaks a harmful script into one of your pages, so it runs in your visitors' browsers as if you had placed it., and the most severe type lets an attacker run code remotely, which is called remote code executionRemote code execution (RCE) means an attacker can make the computer that hosts your site run their own commands from afar. It is among the most serious flaws..

When a flaw is found and reported, it is usually described in a CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. record, the maker publishes a security advisoryA security advisory is an official notice from a software maker about a security weakness: what it is, which versions are affected and how to fix it. and ships a security patchA security patch is a software update that closes one known security weakness and adds nothing else, so installing it protects you against that problem.. The order matters: the flaw exists first, the fix arrives later, and the gap in between is the period in which sites are at risk.

Vulnerability, exploit and attack

These three words are easy to mix up. The vulnerability is the weakness. An exploitAn exploit is a piece of code or a method that turns a software weakness into a real attack. A proof of concept only shows that the attack works. is the method or code that uses it. The attack is someone actually using that method against a target. Only the last one means a site has been touched, which is why the phrase “this site has a vulnerability” does not mean “this site was hacked”.

What it means for a PHP or WordPress site

A typical site is a stack of components, and each one can have vulnerabilities: the PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. runtime, the web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files., the CMSA content management system (CMS) is software that lets you edit the pages, texts and images of your website by logging in, without writing any code., every pluginA WordPress plugin is an add-on you install in WordPress to give your site extra features, such as contact forms, SEO tools or a webshop. and every themeA WordPress theme is a ready-made package that decides how your WordPress site looks and how its pages are laid out. Change the theme and the design changes.. The more code runs when a page is requested, the more places a flaw can sit. This is why old plugins you no longer use deserve as much attention as the ones you do.

An outdated PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. adds one more thing. When a branch is past end of lifeEnd of life (EOL) means the makers have stopped looking after a version of software. It still works, but it no longer gets updates, not even security fixes., new flaws that are found in it no longer get an official fix. That does not mean the site is hacked or certain to be. It means that the site can be exposed to new flaws without a way to close them on that version.

A concrete example

On 21 October 2026 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, which fix two critical vulnerabilities. According to php.net they can allow unauthenticated remote code execution, and all PHP users are strongly encouraged to update immediately. It is a good example of the sequence described above: a flaw, a CVE record, an advisory and a fixed release on the same day. For the full list of facts and what is still unknown, see the PHP2Shell page.

How to check and when to act

Start with a simple inventory: your PHP version, your CMS version and the list of plugins and themes. Your hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. panel or a phpinfo page shows the PHP version, and the free PHP exposure check shows what the outside world can read from your site.

Act when a maker publishes a fix for something you run, and act faster when the advisory says to update immediately. If your site is down, behaves strangely or you suspect it was used, ask us to fix your WordPress website so someone can look at it with you.

Remove what you do not need. A plugin that is switched off but still installed can still hold a flaw, and reducing the attack surfaceThe attack surface is the total of all places where an attacker could try to get in, such as logins, forms, plugins and the code on your server. is cheaper than patching forever.