WordPress Weekly
WordPress
Security
Automation

WordPress Weekly: PHP Patches, Plugin Security and 7.2 Beta — 26 October 2026

By Web Wonderland26 October 2026

If you run a WordPress website, this week's security news is worth checking with your hosting company or web developer. Some of the problems affect the software behind your website, so clicking "update" in WordPress may not be enough.

Our 26 October roundup covers urgent PHP patches, the UpdraftCentral incident, a security problem affecting one Rank Math PRO update and the arrival of WordPress 7.2 Beta 1. There is also a look at new small-business automation tools and an innovation funding opportunity for Essex businesses.

As we discussed in last week's WordPress Weekly, an update can fix a security weakness without undoing changes already made by an attacker. Here is what the latest news means for your website, and when to ask for help.

What to check this week

Ask your hosting company about PHP: it should be able to confirm whether the security fixes have been applied to your website.
If you use UpdraftPlus: check whether the incident affects your website or account.
If you use Rank Math PRO: ask your developer whether the affected update was installed and activated.
Leave WordPress 7.2 Beta off your live site: this early version is for testing.
Have an Essex business idea? the new Innovate Essex Fund may be worth exploring.

1. Ask your hosting company about the PHP security fixes

PHP is part of the software your hosting company uses to run WordPress. Its 21 October security advisory describes two serious flaws that could let an attacker run code on a server without logging in. The patched releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

This is a hosting-level issue: updating WordPress, your theme or your plugins does not update PHP. Some hosts add security fixes to their own supported PHP packages, so the version number you see may not tell the whole story.

There was also a 23 October follow-up about a risk affecting certain server settings. Your host should check whether that applies to your website too. You do not need to change those settings yourself.

WP Engine has confirmed that it has patched its customer sites. If you use another hosting company, ask its support team: "Has my website received the October PHP security fixes, including any action needed following the 23 October advisory?"

2. Use UpdraftPlus? Check whether your website needs attention

TeamUpdraft has reported a security incident involving access details used to connect to customers' websites. It says attackers used that access to create user accounts and install harmful plugins.

UpdraftPlus 1.26.13 and 2.26.13 remove the old UpdraftCentral connections. Your developer should check that the plugin is up to date, but updating alone may not remove unwanted changes already made to a website.

TeamUpdraft asks UpdraftPlus Premium users to inspect their sites even if they never knowingly used UpdraftCentral. Self-hosted UpdraftCentral is unaffected; free UpdraftPlus users without a TeamUpdraft account need no action specifically for this incident.

If your site may be affected, ask your web developer or hosting company to check for unfamiliar user accounts, unwanted plugins and other signs of unauthorised access. Follow TeamUpdraft's instructions for changing your account password and resetting two-factor authentication where needed. If you use Vault, check that your backups are reconnected and working.

Unexpected changes need a proper investigation. A successful update or a clean scan on its own cannot confirm that an affected website has been fully restored.

3. Rank Math PRO users should check one particular update

Rank Math confirms that PRO 3.0.123 contained malware when downloaded or updated between 15 October 2026 at 20:02 UTC and 16 October 2026 at 07:12 UTC. The free plugin was unaffected, and the vendor identifies PRO 3.0.124 as clean.

If that affected version was activated on your website, contact your web developer. Rank Math says to treat the site as compromised, even if a newer version has since been installed.

The vendor recommends restoring a trusted backup of the website and its database from before the incident, then changing affected passwords and access keys and checking the recovered site. Your developer can help you work through those steps.

If the file was only downloaded, or installed without being activated, different guidance applies. Ask whoever manages your website to check what happened against Rank Math's instructions. This is about a specific PRO release, not every website using Rank Math.

4. WordPress 7.2 is taking shape, but wait before upgrading

WordPress 7.2 Beta 1 arrived on 20 October. The final release is scheduled for 8 December. A beta is an early test version, not an update to install on your live business website.

The release includes work on image uploads, the administration area and the ways WordPress connects with other tools. Those changes may be useful, but they need testing with the themes, plugins and custom features your website uses.

For most business owners, there is nothing to install this week. Your developer can try the upgrade on a separate test copy and check that page layouts, forms, image uploads and checkout still work before recommending it for your live site.

That test copy should not take real payments or send messages to customers. Keep ordinary security updates moving in the meantime: waiting for WordPress 7.2 is not a reason to postpone an urgent fix.

5. Could Google's new business tools save you some admin?

Google has announced a Gemini business hub with brand, finance and customer-insight tools, plus connections to services including Business Profile, Ads, Workspace, Shopify and Xero. The announcement describes a global rollout beginning over the following days; check what is available in your account.

If you spend time copying enquiries between systems or pulling together the same report each week, tools like these may be worth exploring. Start with one task you would like to make easier, rather than connecting everything at once.

Check what a tool can see and change before giving it access to your accounts. Try it with non-sensitive information, review the results and keep a way to complete the task yourself if it stops working.

You may not need AI at all: a simple connection between two systems can sometimes solve the problem. Our guide to choosing your first process to automate can help you decide where to begin. If you would like help putting an idea into practice, take a look at our SME Automation Sprints.

6. Innovate Essex Fund: a local opportunity worth checking

The new Innovate Essex Fund supports eligible start-ups, SMEs and social enterprises based in Essex or with significant operations in the county.

Explore: grants of up to £5,000 for early ideas and market opportunities.
Develop: grants from £5,000 to £15,000 to pilot and refine innovative products, services or processes.
Scale: up to £15,000 worth of specialist University of Essex support, rather than a cash grant of that value.

Essex Growth Agency's online briefing on 4 November covers eligibility, supported projects and the application process.

Have an idea for a new digital product, service or a better way of working? The briefing is a useful place to find out whether it could qualify and which costs the fund can cover. Routine website maintenance or a standard redesign is not automatically eligible, so check the programme's criteria before making plans.

Not sure where you stand? Ask your website provider these questions

You do not need to become a WordPress expert to get a clear answer about your website. If this week's news leaves you unsure, ask the person or company looking after it:

Has my hosting software received the latest security fixes?
Does my website use any of the affected plugins or services?
Are my backups working, and could the website be restored if needed?
Does anything need further checking, and who will take care of it?
Who should I contact if I notice something unusual?

If you do not currently have someone looking after your website, our WordPress maintenance and support in Essex can help you understand what needs attention. If you run an agency and need help with your clients' websites, we also offer white-label WordPress development support.

Need help deciding what your website needs?

If something on your website is not working, our WordPress Fix Desk is a place to start. If you think the site has been hacked, let us know: it may need more work than a routine repair, and we can explain the next steps.

Tell us what has happened, share your website address and let us know how it is affecting your business. Please do not send passwords or private access details through the enquiry form. We will arrange a secure way to share access if it is needed.

Sources and further reading

Published 26 October 2026. For the latest advice, check the linked security notices, release information and funding criteria before making changes.

← Back to Blog