Security briefings tagged with PHP
CISA lists the original two flaws as known exploited. Exploitation of the separate session upload progress flaw was unconfirmed in the November 2 review.
Update the PHP runtime using the vendor advisory, and assess CVE-2026-115560 separately. Ask your hosting provider to confirm fixes if it manages PHP.
Last reviewed
UpdateCVE-2026-60137 · CVE-2026-63030
Two related WordPress flaws can expose database contents and allow unauthenticated code execution through distinct SQL-injection and REST API attack paths.
Affected sites can be compromised before sign-in. The July 20 review did not confirm active exploitation.
Check each site's WordPress version and apply the vendor's update or backport guidance. Keep compensating controls in place during remediation.