--- title: WordPress patches pile up, PHP 8.6 keeps chipping away... description: Three separate WordPress vulnerabilities landed this week, including a zero-click RCE chain in Avada that Wordfence's AI agent exploited in two hours flat.... canonical: https://daily.dev/posts/wordpress-patches-pile-up-php-8-6-keeps-chipping-away-at-old-cruft-lsmpv3twb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: WordPress patches pile up, PHP 8.6 keeps chipping away at old cruft | daily.dev og:description: Three separate WordPress vulnerabilities landed this week, including a zero-click RCE chain in Avada that Wordfence's AI agent exploited in two hours flat.... og:url: https://daily.dev/posts/wordpress-patches-pile-up-php-8-6-keeps-chipping-away-at-old-cruft-lsmpv3twb og:image: https://api.daily.dev/og/posts/LsMPV3tWB.png og:image:alt: WordPress patches pile up, PHP 8.6 keeps chipping away at old cruft og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # WordPress patches pile up, PHP 8.6 keeps chipping away at old cruft **[PHP Digest](https://daily.dev/sources/php_digest)** · 4 min read · 6 upvotes · 0 comments ## Summary Three separate WordPress vulnerabilities landed this week, including a zero-click RCE chain in Avada that Wordfence's AI agent exploited in two hours flat. Laravel 13.27 shipped a batch of small but genuinely useful additions: binding masking, whereBinary, and refreshForUpdate. PHP 8.6 keeps clearing decades-old debt, replacing stream_select() with a native polling API and finally letting readonly properties have defaults. Symfony pushed out coordinated security releases across three supported branches at once. ## Content **TLDR:** Three separate WordPress vulnerabilities landed this week, including a zero-click RCE chain in Avada that Wordfence's AI agent exploited in two hours flat. Laravel 13.27 shipped a batch of small but genuinely useful additions: binding masking, whereBinary, and refreshForUpdate. PHP 8.6 keeps clearing decades-old debt, replacing stream_select() with a native polling API and finally letting readonly properties have defaults. Symfony pushed out coordinated security releases across three supported branches at once. --- ## Avada theme zero-click RCE chain, found by an AI agent in two hours CVE-2026-18431 (CVSS 9.8) chains six separate flaws across the Avada theme and Fusion Builder plugin into unauthenticated remote code execution. Wordfence's Argus agentic framework discovered and built a working exploit for the whole chain in about two hours, which says something about where vulnerability research is headed. Exploitation needs vulnerable versions of both Avada (up to 7.16) and Fusion Builder (up to 3.16) active together, which narrows the blast radius, but Avada has sold over a million licenses. Patched in Avada 7.16.1 and Fusion Builder 3.16.1. [Read more](https://daily.dev/posts/Jpzo0b0AO) ## GiveWP unserialize chain lets attackers run server commands CVE-2026-82222 in the GiveWP donation plugin chains an unsafe unserialize helper, an exposed registration action that works even when registration is disabled, and a gadget chain in bundled libraries. Attackers create an account, submit a crafted donation, and get a malicious serialized object stored and executed on the next page load. Fixed in 4.16.7.2 on August 27 - worth remembering this is the same plugin that was previously used to breach Pi-hole and expose 30,000 donor records. [Read more](https://daily.dev/posts/6dNxnClQY) ## Laravel 13.27 quietly fixes a logging privacy problem and adds real locking primitives The mask_bindings_in_exception_messages config stops emails, tokens, and other bound values from leaking into QueryException messages, logs, and APM traces - a real fix for something a lot of teams probably didn't realize they were exposing. Same release adds refreshForUpdate() to combine refresh() and lockForUpdate() into one call (and correctly routes through the write connection so a stale replica can't undercut the lock), plus whereBinary() for byte-exact MySQL/MariaDB comparisons without dropping into whereRaw(). [Read more](https://daily.dev/feed-by-ids?id=0B2mdx6ak&id=UKFzaytcA&id=9q7j7mxvL&id=cJmMNMpZQ) ## PHP 8.6 replaces stream_select() and unlocks readonly property defaults The new Io\Poll API (RFC passed 33-1) swaps the old fixed-size, 1024-descriptor stream_select() for epoll/kqueue/WSAPoll-backed polling with proper Context/Watcher/Handle classes - event loop libraries like AMPHP and ReactPHP still sit on top, but now they get one efficient native backend instead of a decades-old bottleneck. Separately, the four-year-old restriction blocking default values on readonly properties is lifted, which mainly matters now that PHP 8.4's interface properties force awkward constructor boilerplate just to hardcode a fixed value. Both target the November 19 PHP 8.6 GA. [Read more](https://daily.dev/feed-by-ids?id=sGc2PmwCJ&id=ji44Xhk9o) --- ## Also notable - **Symfony ships coordinated security releases across three branches:** Symfony 6.4.45, 7.4.18, and 8.1.6 all landed with the same hardening batch - decompression bomb rejection, capped rate-limiter bursts, and validated webhook signature timestamps for Mailgun, SendGrid, Vonage, and Postmark. [Read more](https://daily.dev/feed-by-ids?id=D8HiU7gNc&id=25p6ptYsW&id=Nk9FKTyvz) - **miniOrange SAML bypass leaves 30,000 paid WordPress sites exposed:** CVE-2026-61979 and CVE-2026-15981 let attackers forge SAML responses and log in as admin, and because the vendor's public advisory only covered the free edition, paid customers got no dashboard warning even though a patch existed since July. [Read more](https://daily.dev/posts/ayeDWsaYu) - **Playwright-PHP cuts a Symfony test suite's runtime in half:** Running E2E tests through the Symfony kernel directly instead of over HTTP dropped one migrated test suite from ~39 seconds to ~18 seconds, and Zenstruck Browser has already deprecated Panther in favor of it. [Read more](https://daily.dev/posts/LZ5xDMgdk) - **WordPress Core Security Initiative responds to AI-driven report surge:** The core security team is building a more automated release process and adding contributors specifically to clear the backlog toward zero, a direct response to AI-assisted vulnerability research flooding HackerOne with reports. [Read more](https://daily.dev/posts/Jr3ozaElV) - **Simple Data Objects claims 60x faster DTO hydration via compiled hydrators:** The PHP 8.4+ library generates per-class hydrator/serializer closures at build time instead of using runtime reflection, and ships a benchmark repo so the 60x number against the leading Laravel data-object library can be independently checked. [Read more](https://daily.dev/posts/HNcmWVHqO) --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#wordpress](https://daily.dev/tags/wordpress), [#laravel](https://daily.dev/tags/laravel), [#symfony](https://daily.dev/tags/symfony) [View this post on daily.dev](https://daily.dev/posts/wordpress-patches-pile-up-php-8-6-keeps-chipping-away-at-old-cruft-lsmpv3twb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/wordpress-patches-pile-up-php-8-6-keeps-chipping-away-at-old-cruft-lsmpv3twb","headline":"WordPress patches pile up, PHP 8.6 keeps chipping away at old cruft","text":"Three separate WordPress vulnerabilities landed this week, including a zero-click RCE chain in Avada that Wordfence's AI agent exploited in two hours flat. Laravel 13.27 shipped a batch of small but genuinely useful additions: binding masking, whereBinary, and refreshForUpdate. PHP 8.6 keeps clearing decades-old debt, replacing stream_select() with a native polling API and finally letting readonly properties have defaults. Symfony pushed out coordinated security releases across three supported branches at once.","url":"https://daily.dev/posts/wordpress-patches-pile-up-php-8-6-keeps-chipping-away-at-old-cruft-lsmpv3twb","datePublished":"2026-08-31T04:19:24.923Z","dateModified":"2026-08-31T04:19:46.174Z","author":{"@type":"Organization","name":"PHP Digest","logo":"https://media.daily.dev/image/upload/s--nXhH7T2u--/f_auto,q_auto/v1773839413/logos/php_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/php_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":6},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/php_digest","name":"PHP Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"PHP Digest","item":"https://daily.dev/sources/php_digest"},{"@type":"ListItem","position":3,"name":"WordPress patches pile up, PHP 8.6 keeps chipping away at old cruft"}]} ```