Open Source CMS Reports

On 21 October 2026, the PHP project shipped emergency security releases that closed two of the most severe vulnerabilities the language has faced in years. Tracked as CVE-2026-109618 and CVE-2026-109619 and widely referred to as PHP2Shell , both flaws carry a CVSS v4.0 score of 9.2 and enable unauthenticated remote code execution in the PHP runtime itself. This is not a plugin vulnerability. It is not a theme flaw. It is not even a WordPress, Drupal, or Magento bug. It is a memory-safety failure deep inside the interpreter that powers roughly 70% of the web whose server-side language is known. For application architects and CMS operators, the distinction is fundamental: updating the application layer does nothing. The runtime must be patched. What Exactly Broke CVE-2026-109618 – RCE via OOM Corruption PHP uses longjmp() to abort request handling when memory limits are hit. In certain contexts—particularly during multipart form parsing—request memory can exist in a partially initialize...

As we publish this in April 2026, open-source CMS platforms power the majority of the web—from small business blogs to enterprise portals. But with great popularity comes an equally massive attack surface. Last year’s supply-chain security post highlighted how third-party components (plugins, themes, libraries) have become the weakest link in modern web infrastructure. Fast-forward to 2026, and those warnings have materialized even more clearly: the OWASP Top 10:2025 now ranks Software Supply Chain Failures (A03) as the third-most critical risk, directly expanding the 2021 category of “Vulnerable and Outdated Components.” The numbers don’t lie. WordPress alone recorded 11,334 new vulnerabilities in 2025 —a 42% jump from 2024—with 91% originating in plugins and just 6 low-priority issues in core. Drupal, by contrast, continues to earn praise for robust core security and stricter contribution standards. Joomla sits in the middle, while headless architectures shift the battleground to A...