--- title: "WordPress RCE chain goes public, PhpStorm 2026.2 ships" url: https://daily.dev/posts/wordpress-rce-chain-goes-public-phpstorm-2026-2-ships-3pzqrgqro source_url: https://daily.dev/posts/wordpress-rce-chain-goes-public-phpstorm-2026-2-ships-3pzqrgqro type: freeform source: "PHP Digest" published: 2026-07-20T04:20:40.620Z updated: 2026-07-20T04:21:00.300Z tags: ["security", "php", "wordpress", "laravel"] reading_time: 4 upvotes: 11 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # WordPress RCE chain goes public, PhpStorm 2026.2 ships **[PHP Digest](https://daily.dev/sources/php_digest)** · 4 min read · 11 upvotes · 0 comments ## Summary Two chained WordPress CVEs dubbed wp2shell enable unauthenticated remote code execution on default installs running 6.8 through 7.0.1, with public proof-of-concept exploits already in the wild. WordPress maintainers enabled forced auto-updates, but you should manually verify every site you manage is on 7.0.2, 6.9.5, or 6.8.6. PhpStorm 2026.2 landed with GitHub Copilot integration, a new Laravel tool window, and TypeScript 7 support. Laravel 13.20 shipped a first-party Image facade and a migration timestamp fix that matters if you use AI agents to scaffold code. ## Content **TLDR:** Two chained WordPress CVEs dubbed wp2shell enable unauthenticated remote code execution on default installs running 6.8 through 7.0.1, with public proof-of-concept exploits already in the wild. WordPress maintainers enabled forced auto-updates, but you should manually verify every site you manage is on 7.0.2, 6.9.5, or 6.8.6. PhpStorm 2026.2 landed with GitHub Copilot integration, a new Laravel tool window, and TypeScript 7 support. Laravel 13.20 shipped a first-party Image facade and a migration timestamp fix that matters if you use AI agents to scaffold code. --- ## WordPress wp2shell: unauthenticated RCE via chained CVEs, patch now CVE-2026-63030 (REST API batch-route confusion in 6.9+) and CVE-2026-60137 (SQL injection in WP_Query author__not_in, affecting 6.8+) chain together to give an unauthenticated attacker full remote code execution on a stock WordPress install. Public proof-of-concept exploits are on GitHub and in-the-wild exploitation has been reported. Fixed versions are 7.0.2, 6.9.5, and 6.8.6. Forced auto-updates are enabled, but auto-updates don't always fire reliably — verify every internet-facing site manually. If you can't patch immediately, block /wp-json/batch/v1 at your WAF; Cloudflare has deployed block-mode rules across all plans including free. [Read more](https://daily.dev/feed-by-ids?id=Y6lk9nTq1&id=a8V4Yfi1G) ## PhpStorm 2026.2 released with Copilot integration and Laravel tool window PhpStorm 2026.2 adds native GitHub Copilot integration via a JetBrains-Microsoft partnership, support for third-party OpenAI-compatible providers in code completion, and an MCP server setup for terminal AI sessions. Laravel developers get a dedicated tool window with a dashboard, error browsing, and Laravel Cloud management. TypeScript 7 lands with up to 4x faster type-checking, and project indexing is up to 10% faster. The #[FileReference] attribute for persistent file path references and PER Coding Style 3.0 support round out the PHP-specific additions. [Read more](https://daily.dev/posts/hFtm1SQSi) ## Laravel 13.20: Image facade and migration timestamp collision fix The headline addition is a new Image facade backed by Intervention Image v4 — you still pull in intervention/image via Composer, but Laravel wraps it with a fluent immutable API covering resize, crop, format conversion, and storage in one chain. More quietly important: a fix for migration timestamp collisions when multiple migrations are generated within the same second. SQLite silently ignores the ordering problem while MySQL throws foreign key errors, so AI-generated migration scaffolding against SQLite dev databases was a common source of production surprises. The release also adds a #[WithoutMiddleware] controller attribute, a dedicated Redis session prefix to avoid cache key collisions, and #[SensitiveParameter] on secret-carrying parameters to reduce accidental exposure in error logs. [Read more](https://daily.dev/posts/hgi55fW6F) ## Packagist and Composer supply chain: immutable metadata live, gaps remain Packagist's immutable stable version metadata (launched July 7, 2026) is covered in a detailed review of the PHP ecosystem's supply chain posture following real attacks on packages including laravel-lang and devdojo/wave. Composer 2.9 added automatic security advisory blocking; 2.10 introduced a Dependency Policy Framework with malware filtering at install time. The cross-manifest attack on wave is worth understanding separately: the attacker hid a malicious postinstall script inside package.json in the PHP vendor directory, so npm install triggered a curl command that downloaded and executed a hidden binary. Remaining gaps include mandatory MFA, Trusted Publishing via OIDC, and Sigstore attestations. [Read more](https://daily.dev/feed-by-ids?id=isfJ6hklj&id=zSnTaZno9) --- ## Also notable - **Two Joomla extension zero-days (CVSS 10.0) under active exploitation, patches available:** CVE-2026-48939 (iCagenda, fixed in 4.0.8/3.9.15) and CVE-2026-56291 (Balbooa Forms, fixed in 2.4.1) are unrestricted file upload flaws allowing unauthenticated RCE, both added to CISA's KEV catalog with federal agencies given a three-day patch deadline — check upload directories for unexpected PHP files as the first sign of compromise. [Read more](https://daily.dev/posts/4DAXgFZgy) - **PHP Foundation hires security contractor as AI-generated reports strain triage capacity:** The PHP Foundation hired Alexandre Daubois (CTO of Les-Tilleuls.coop, Symfony/FrankenPHP contributor) as a part-time security contractor to triage php-src reports, with the volume increase partly attributed to AI tools making it easier to generate security reports. [Read more](https://daily.dev/posts/RaNC1skvG) - **PHP 8.6: array_map with first-class callables gets ~10% speedup, up to 1.7x with JIT:** PHP 8.6 introduces a compiler optimization that rewrites array_map calls using first-class callables into for-each loops at compile time, with a real-world Doctrine ORM example showing a 56% gain in hot paths — closures are not yet covered by the optimization. [Read more](https://daily.dev/feed-by-ids?id=q2NSPygyP&id=Q4tuPjHNk) - **Symfony UX 3.3.0 adds Reprise support and two new Shadcn components:** Symfony UX 3.3.0 adds first-class support for Symfony Reprise (the new Vite/Rsbuild asset integration) in StimulusBundle and ships two new Shadcn Toolkit components: Sonner (toast notifications) and Combobox (searchable autocomplete). [Read more](https://daily.dev/feed-by-ids?id=2m9QuuFIM&id=tjavNJguf) - **SecretSpec 0.15 ships PHP SDK with Laravel and Symfony support, adds Azure Key Vault:** SecretSpec 0.15 adds a Composer-installable PHP SDK supporting PHP-FPM, Laravel, and Symfony via native extension or ext-ffi, alongside new Azure Key Vault and Gopass providers and a secretspec export command for shell, dotenv, JSON, and GitHub Actions output formats. [Read more](https://daily.dev/posts/3fhN9qofy) --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#wordpress](https://daily.dev/tags/wordpress), [#laravel](https://daily.dev/tags/laravel) [View this post on daily.dev](https://daily.dev/posts/wordpress-rce-chain-goes-public-phpstorm-2026-2-ships-3pzqrgqro)