Patchstack

Fastest vulnerability protection for WordPress websites! Official security partner for the leading web hosting companies, agencies, and plugin devs.

[Patchstack @patchstackapp]

Details & instructions: https://t.co/2pMtc4K3mt

[Patchstack @patchstackapp]

⚠️ PHP critical security fix is now live - this is serious, so update immediately ⚠️

Make sure you update to: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

More details & instructions in the post below:

[Patchstack @patchstackapp]

Our announcement & live updates here: https://t.co/2pMtc4K3mt

[Patchstack @patchstackapp]

⚠️ Important: critical PHP vulnerability release imminent. ⚠️

Significant impact across WordPress, Drupal, Joomla, Magento.

Be ready to update your PHP version. Watch this channel for more info.

[Patchstack @patchstackapp]

*** ⚠️ Update 07:34AM UTC *** - multiple active exploitation incidents confirmed. Be ready

[Patchstack @patchstackapp]

New: PHP security update scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

[Patchstack @patchstackapp]

👇If you're a web host, looking to host NodeJS apps and vibe coded websites. We should talk!

[Oliver Sild @OliverSild]

⚡ @WebhostingToday reached out to both us (@patchstackapp) and @Hostinger to talk about the partnership we launched to protect the NodeJS apps.

So far, it has detected vulnerable dependencies on more than 10,000 customer websites, with thousands of issues resolved through automatic fixes or manual updates within just a few weeks.

Even though @Hostinger was the fastest to act, we are expanding our support to Javascript ecosystem with all our web hosting partners. Vibe coding is the "new WordPress" for many non-technical builders, but also for web hosting companies that need to answer to the demand and provide hosting.

The average customer profile behind a WordPress website and a vibe coded app is the same - and so are the security challenges.

If you're a web host looking towards Javascript/NodeJS hosting or you're building your own vibe coding tool, let me know. I have something to show you! 😎

https://t.co/5bGf5ieIPs

[Patchstack @patchstackapp]

⚡ 3 weeks have passed since the WordPress 7.0.2 Remote Code Execution patch. Now, WordPress core patched another 12 vulnerabilities. Patchstack users protected at disclosure. More details in our advisory.

https://t.co/bXc8TlvCqI

[Steve Burge @SteveJBurge]

Kudos to @OliverSild 🙇‍♂️

@patchstackapp sent us a security report. We patched the plugin, but when the report went live, the priority report was too high.

I pinged Olivier. He listened, researched, and fixed the issue.

It's not surprising that Patchstack is doing so well 👏

[Oliver Sild @OliverSild]

Weeks ago when #WP2Shell dropped and OpenAI Sol Ultra took most of the credit - all I thought about was how all the other labs and AI-pentest companies will rush to prove they can find something in the WordPress core too.

Well, today, 3 weeks later - we have the next WordPress core version release with not one, but 12 vulnerabilities being patched. And as expected, the issues have been reported by @AnthropicAI , @pwn_ai , @AikidoSecurity and others.

The nastiest one is a login screen XSS, which via some social engineering could lead to Remote Code Execution. Luckily, WordPress is auto-updating fast and none of the vulnerabilities are mass-exploitable like WP2Shell was.

As always, @patchstackapp customers received mitigation rules right at the disclosure.

https://t.co/qqkQWMJaN0

[Patchstack @patchstackapp]

Full report here! https://t.co/2qcpCOpfZ7

[Patchstack @patchstackapp]

Our "State of WordPress Security 2026" report is now live! 💥

This year we took a step back to look at the impact of vulnerabilities rather than the overall numbers.

We also teamed up with Monarx to explore how malware campaigns and techniques evolved during 2025.

**Key learnings:**

⚠️ More high severity vulnerabilities were found in 2025 than in the two previous years *combined*

⚡ Median time from discovery to mass exploitation for severe vulnerabilities is just 5 hours

❌ 46% of vulnerabilities were not fixed by developer by the time of public disclosure

💸 76% of vulnerabilities found in premium components were exploitable

🥷 Increased usage of uploader scripts suggests attackers are adopting more complex strategies

Read the whitepaper for the full insights ( 🔗 link in comments!)

[Modular DS @ModularDS]

Si te dedicas al mantenimiento de webs de WordPress, sabes que la seguridad no es opcional. Es una parte esencial del servicio que ofreces a tus clientes.

Por eso, este webinar con @patchstackapp está pensado para ti 💜

📅 16 de diciembre a las 17:00 CET
🎟️ Online y gratuito

[WP Umbrella ⓦ @wpumbrella]

Friday Feature Focus: Site Protect.

Powered by @patchstackapp, it runs at the PHP level with zero impact on performance

Virtual patches applied automatically
Malicious IPs blocked
User enumeration disabled
XML-RPC restricted to authenticated users

One toggle. €2/site/month

[Patchstack @patchstackapp]

@no_fear_inc @OliverSild @FrancescaMarano No idea what’s written there, but thanks! 🤩

[Marco Almeida @MarcoAlmeidaPT]

Wanna feel safe? Put your @patchstackapp socks on!

[Elliot @ejntaylor]

😱 When your security tool has a vulnerability of its own...

A critical RCE vulnerability was discovered in a major security tool used on 56 million+ websites and almost no one was talking about it.

So the @patchstackapp research team did.

[GoDaddy Pro @GoDaddyPro]

We are thrilled by reports back from Scott & @courtneyr_dev .... 22 devs, 1 day, a working security-labeling layer connecting @fair_pm, @patchstackapp & #WordPress packages. Proud to support this step toward decentralized, DID-powered plugin security. Many thanks @CaroleOlinger

[Aurelio @ WP Umbrella @AurelioVolle]

87.8% of vulnerability exploits still bypass hosting defenses, and too many agencies assume hosts keep them safe but the data says otherwise.
So we’ve dropped Site-Protect (virtual patching) from €3 → €2.
Real protection should be accessible to everyone. Thanks @patchstackapp

[Elliot @ejntaylor]

What an epic day... Just doing a roundup now of the hackathon for the https://t.co/oZYLpAkdrz x @patchstackapp security labeller! Well done everyone