Security
Articles in Security.
php2shell in the Wild: What Attackers Tried in the First 14 Hours, and What Stopped Them
Attacks on php2shell reached InstaWP-hosted sites 2h20m after disclosure. None succeeded. What each campaign tried, and which PHP setting stopped it.
PHP Security Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell): What InstaWP Customers Need to Know
Live updates on the php2shell PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): what InstaWP has done, and what you need to do based on your site's PHP version.
Is MCP WordPress Integration Safe and Secure? What InstaMCP Locks Down
Yes, if you limit what the AI agent can do. InstaWP tested InstaMCP 1.11.4 on a throwaway sandbox: role-scoped tokens, Safe Mode, power tools off by…
WordPress Virtual Patching: How We Block a Plugin Exploit Before You Can Update
Virtual patching blocks a WordPress exploit at the web server, before PHP runs, so a site is protected while it still runs the unpatched plugin. How…
WordPress Plugin Security Best Practices Now That WordPress.org Scans Every Release
WordPress.org now reviews every plugin and theme release before distributing it, and blocks high-risk releases. Here is exactly what that check covers, the four gaps it…
Elementor Pro Critical RCE (CVE-2026-32475): What It Means and What We Did
A critical unauthenticated file upload to RCE flaw in Elementor Pro, affecting every version up to 4.2.1. What the bug actually is, who is really at…
Inside Our wp2shell Response: How We Protected the Fleet From a WordPress Core RCE (CVE-2026-63030)
The full engineering story of how InstaWP detected, blocked and verified protection against wp2shell (CVE-2026-63030), a pre-auth WordPress core RCE, fleet-wide and within hours.
Securing WordPress Development Environments: A VPN’s Hidden Role
Here’s something that keeps developers up at night: WordPress powers 43.2% of the web, and hackers know exactly where developers are weakest. It’s not the production…
InstaWP Security Shield Compared: Basic vs Premium for WordPress Site Protection
If you’re building or managing WordPress sites in 2026, you know this already: security is no longer a plugin checkbox. It’s the foundation of site performance,…
10 Critical Signs Your WordPress Site Is Hacked in 2026 (Step-by-Step Fix Guide)
Is your WordPress site acting strange lately? Maybe it’s loading painfully slow, showing unexpected pop-ups, or you’ve discovered mysterious admin users you never created. These aren’t…