Two PHP vulnerabilities disclosed July 2025 — CVE-2025-1736 and CVE-2025-1861, collectively PHP2Shell — affect every WordPress site. The worst scores 9.8 CVSS and requires no account to exploit. No plugin or WordPress update fixes this. The patch must be applied at server level by your host. If you manage your own server, check your PHP version now. #WordPress #PHP #Security #WordPressSecurity #WebHosting https://wpguy.uk/blog/php2shell-critical-php-vulnerabilities-affecting-wordpress/