Security alerts
Recent problems that affect small-business websites, in plain language: when it happened, who’s affected, what to do, and where the facts come from.
Latest alerts
- WordPress 7.1.4 fixes 13 security issues (October 2026) WordPress 7.1.4, released on October 28, 2026, is a security release that fixes 13 issues, including a flaw in the update process that could allow code to run on the server. WordPress recommends updating immediately. Most sites update themselves; check yours shows 7.1.4, or the matching fix for an older branch.
- Critical PHP flaws let attackers take over web servers (October 2026) On October 21, 2026, the PHP project released emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, that could let an attacker run code on a web server with a single request. Almost every WordPress site runs on PHP. The fix is on the server, so ask your host to confirm it's patched.
- Elementor Pro form uploads let attackers take over sites (August 2026) Elementor Pro 4.2.1 and older had a critical flaw, CVE-2026-32475, that let anyone upload a program through a form's file upload field and take over the site. Version 4.2.2 fixed it on August 19, 2026, and attacks began the same day. Update Elementor Pro, then check the forms upload folder for files that shouldn't be there.
Severity is our plain-language reading of the official advisory, not a score of our own. Alerts are reviewed every month; older ones are marked resolved and later retired. For dates when software stops getting fixes, see the end-of-life tracker.
Not sure whether your own site is exposed? The free website check looks for outdated, publicly visible software on it.
Not sure if this affects you?
Call, and we’ll tell you plainly whether your site is affected and what to do. Or start with a free check of your website.