Most WordPress security scares are about plugins. This one was not, and that is what made it rare. On July 17, 2026 the WordPress security team shipped an emergency fix for a flaw in WordPress’s own core code, a chain nicknamed wp2shell that let an attacker with no account take over a stock site. WordPress then did something it … Continue reading A Once-a-Decade WordPress Core Flaw, and the Gap Between Patched and Safe