Changelog

October 2026 - PHP2Shell, stolen management keys and a poisoned Pro release

• Chapter 1: the 21 October PHP flaws (CVE-2026-109618 and CVE-2026-109619) as the worked example for PHP support windows; PHP-FPM over mod_php; how to tell a backported distribution package is patched; post_max_size brought down from 64M to 32M; session.upload_progress.enabled and register_argc_argv added to the settings list
• Chapter 2: the three 7.1 security releases in nineteen days, and CVE-2026-87902 as the current example of why point releases are not optional
• Chapter 8: a fourth shape of supply-chain attack, stolen remote management keys (UpdraftCentral, 18 and 19 October); Rank Math PRO 3.0.123 added to the second; keys and connections added to the inventory; the WordPress.org cooldown noted as not covering vendor-hosted premium updates
• Chapter 1: where Nginx comes from (distribution backports versus nginx.org) and how to read an nginx advisory against your own configuration
• Chapter 6: Let's Encrypt's move to 64-day certificates from February 2027, ACME Renewal Information and the stale Certbot in Ubuntu's archive, and why Certbot's TLS snippet sidestepped the October nginx session forgery bug
• Chapters 11, 12 and 13: revoke management keys as part of recovery, why a cookie-setting backdoor makes 2FA irrelevant until the code is gone, restore from before the advisory date when persistence is spread across core, options, cron and mu-plugins, and a monthly review of connections and of accounts whose capabilities do not match their role

September 2026 - WordPress 7.1 follow-up

• Chapter 14: the WordPress 7.1 Abilities API filters that can bypass or override an ability's permission check, how to find plugins that hook them, and wp_ability_invoked as the audit-log hook that sees short-circuited calls
• Chapter 8: EssentialPlugin timeline corrected (the backdoor shipped dormant in August 2025 and was switched on in April 2026); the OptinMonster CDN attack added as the third supply-chain shape; WordPress 7.1 and WP Rocket as the current staging example
• Chapter 1: client-side media processing in 7.1 and what it does and does not do for the Imagick attack surface
• Chapters 11 and 12: re-enrol 2FA after a compromise, because the ShapedPlugin payload harvested TOTP seeds
• Chapter 2: 7.0.2 as a forced update and why majors stay manual

September 2026 - Persistence, hashing and depth pass

• Redis and Valkey exposure added to Chapter 9: bind to loopback, protected-mode, and why an open instance is a remote code execution path that survives a file cleanup
• OPcache poisoning added to Chapter 9: validate_timestamps=0 as a persistence mechanism and why a cleanup must flush the cache
• bcrypt (WordPress 6.8) and the value of a stolen wp_users table added to Chapter 3; scheduled 90-day password expiry dropped in favour of rotate-on-evidence, per current NIST guidance
• Plugin auto-update rollback (WordPress 6.3) noted in Chapter 8
• .git in the webroot added to Chapter 12's deployment section
• Chapter 5 prefix-change corrected (references, not table names; no multisite --network flag) and Chapter 7 robots.txt no longer blocks plugin and theme assets

September 2026 - Email authentication and phishing

• SPF, DKIM and DMARC added to Chapter 2's email section, with the records to publish and the order to roll them out
• New phishing section in Chapter 3: the lures aimed at WordPress admins (fake update notices, fake host infection emails, admin-email changes) and why passkeys are the structural fix

September 2026 - Chapter 14 rewrite

• Chapter 14 rewritten with runnable detail: the wp ability commands and REST endpoints for auditing what is exposed to MCP, the real provider-key constant names the Connectors API reads, and a concrete way to disable the adapter
• New section on prompt injection: how attacker-written content (comments, reviews, form submissions) can steer an agent, why the capability check does not catch it, and the least-privilege and read-only defences that do

September 2026 - Currency pass

• Protect The Shire cooldown corrected to six hours, and the automated release review that now blocks bad releases added to Chapters 8 and 12
• Patchstack's 2026 figures on vulnerability volume and time to exploitation added to Chapter 8
• Elementor Pro's exploited file-upload flaw added to Chapter 2 as the worked example for blocking PHP in uploads
• WordPress 7.1 and the September core security initiative noted in Chapter 2
• Apache examples moved to 2.4 Require syntax throughout; the 2.2 Order form fails silently on current servers
• wp-config.php permissions made consistent at 440 across every chapter
• The crisis runbook now matches Chapter 11 on stopping PHP rather than using maintenance mode
• PHP and Ubuntu support windows restated as fixed dates

August 2026 - WordPress 7.0 and the AI agent stack

• New Chapter 14 on AI agents and the MCP attack surface introduced in WordPress 7.0
• Updated the hosting chapter for current PHP support and the Imagick/Ghostscript RCE class
• Expanded the Application Passwords guidance now that agents authenticate with them
• Added coverage of the plugin update cooldown ("Protect The Shire") to the plugin and maintenance chapters
• Added a print-quality PDF edition, included with every purchase and downloadable from the reader. The web reader remains the canonical, continuously updated version; the PDF is a dated snapshot of it

May 2026 - Hardening additions

• Expanded coverage of file and information leaks at the server level
• Added a working example for restricting origin traffic to Cloudflare's IP ranges
• New guidance on auditing the must-use plugins folder for unauthorised files

April 2026 - Initial release

• All 13 chapters published
• Foreword, disclaimer, and outro added
• Covers WordPress 6.x, PHP 8.3 and 8.4, current plugin landscape as of April 2026