From report to attack: how a flaw reaches your site

The four stages of a security flaw, how fast attacks follow in WordPress software, and the case PHP2Shell stage by stage, with the PHP versions that fix it.

Key points

A security flaw goes through four stages: someone finds it, the developer fixes it, it becomes public, and attackers use it. Your site is at risk from the moment it becomes public until you install the fix.
For WordPress software, Patchstack measured about five hours from disclosure to the first attack on heavily exploited flaws. 46% of the flaws had no fix at disclosure.
The case PHP2Shell shows the stages in PHP itself: reported on August 11, 2026, fixed and made public on October 21, 2026.

The four stages

Found: a researcher, or an attacker, finds the flaw.
Reported: a responsible finder reports it privately to the developer, who prepares a fix.
Public: the fix comes out together with a description of the flaw. The flaw gets a CVE number and a severity score from 0 to 10 (CVSS).
Exploited: attackers use the description, and often the fix itself, to build an attack. Bots then look for sites that have not installed the fix.

Between stages 3 and 4 there is often little time. Patchstack measured that heavily exploited flaws in WordPress software were first attacked about five hours after disclosure, and about half of the high-impact flaws within 24 hours. For 46% of the flaws, stage 3 came before the fix: the developer had no fix ready when the flaw became public.

PHP2Shell, stage by stage

PHP2Shell is the name of two flaws in PHP itself, the language that WordPress and many other applications run on. This archive followed the case:

Date	What happened
August 11, 2026	The flaws are reported to the PHP developers
August 24, 2026	Wiz Research reports further bugs, independently
September 18, 2026	OpenAI reports further attack paths
October 20, 2026	The CVE numbers leak online, with a wrong score of 10.0
October 21, 2026	PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix the flaws, and the details become public

The finders took over eleven applications with these flaws, WordPress among them. The score is 9.8 of 10. Ten weeks passed between the first report and the fix, and the fix came out on the day the flaws became public. A host that updated PHP that day closed the gap for its customers on the first day. The case page PHP2Shell lists every version and what to do.

Where you can shorten the gap

Part	How the fix reaches your site
Plugins and themes	automatic updates, if you turned them on
WordPress	automatic security releases, on by default
PHP	your host installs the new version
A flaw without a fix	only removing the plugin or a firewall rule protects you

What you can do

Turn on automatic updates for every plugin and theme, so that fixes arrive within hours.
Know your PHP version. It is under Tools › Site Health › Info, in the section “Server.” When a flaw in PHP becomes public, compare it with the fixed versions.
Ask your host how fast it installs PHP fixes. For PHP2Shell, the fixed versions came out on the day of disclosure.
Put a firewall in front of your site that gets new rules quickly. It can protect you while no fix exists.
Remove plugins that no longer get updates. A flaw in them may never be fixed.

Next step

The guide WordPress updates: core, plugins, themes, and PHP shows which updates install themselves and which PHP versions still get fixes.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.