The second half of July 2026 was all about security. WordPress 7.0.2 fixed a critical REST API issue that could lead to remote code execution, serious enough that WordPress.org forced updates, BuddyPress 14.5.2 shipped security fixes, PHP shipped its second security release of the month, and Oracle's July Critical Patch Update fixed 54 MySQL issues. MySQL 26.7.0 also started calendar versioning, Angular published three advisories, and Capacitor 8.5 prepared apps for the iOS 27 scene requirement. Here is what shipped and what it means for your website and app.
What shipped at a glance
| Release | Date | Type | Action |
|---|---|---|---|
| WordPress 7.0.2 | July 17, 2026 | Critical security release | Update now |
| BuddyPress 14.5.2 | July 29, 2026 | Security release | Update |
| PHP 8.5.9, 8.4.24, 8.3.33 and 8.2.33 | July 30, 2026 | Security release | Update now |
| MySQL July 2026 Critical Patch Update | July 21, 2026 | Security | Apply 8.4.11 or 9.7.2 |
| MySQL 26.7.0, 8.4.11 and 9.7.2 | July 28, 2026 | Major release | Check OS support |
| Angular security advisories | July 29, 2026 | Security | Update Angular packages |
| Capacitor 8.5 | July 31, 2026 | Required update | Migrate before Xcode 27 |
WordPress 7.0.2 security release
WordPress 7.0.2 was released on July 17, 2026, to fix a facilitated SQL injection (CVE-2026-60137) and a REST API batch route issue that could lead to remote code execution (CVE-2026-63030). Because of the severity, WordPress.org enabled forced updates, and WordPress 6.9 and 6.8 were fixed in 6.9.5 and 6.8.6. Confirm the version on every site, since some sites block automatic updates.
For the full write up, read our standalone post: WordPress 7.0.2 Closes a SQL Injection and a REST API Code Execution Flaw.
BuddyPress 14.5.2 security release
What shipped
BuddyPress 14.5.2 was released on July 29, 2026, together with 12.7.2 and 11.6.2. It fixes one security issue: before returning an activity item, the activity AJAX handlers now check that the person asking is allowed to see it. It also makes BP Nouveau enforce the strong password level and removes PHP 8.4 deprecation notices.
What it means for you
Without this fix, a crafted request could return activity items to people who were not allowed to view them. If your community keeps any discussion behind membership, update now. Members creating new passwords on BP Nouveau sites will now need a strong one.
How we use it in WordPress builds
Through our BuddyPress development service we update on staging, then check private group activity, the activity stream filters and the registration and password screens before production. We also check PHP error logs on PHP 8.4 hosts to confirm the deprecation notices are gone.
What it means for mobile apps
AppPresser apps that show activity streams pull them from the same handlers and endpoints, so this fix also keeps private activity out of the app for people who should not see it. No app store update is needed.
What to do next
- Confirm every site shows BuddyPress 14.5.2 or later.
- Tell members that new passwords now need to be strong on BP Nouveau sites.
- Let our support and maintenance team handle it for you.
PHP 8.5.9, 8.4.24, 8.3.33 and 8.2.33 security releases
What shipped
PHP 8.5.9, 8.4.24, 8.3.33 and 8.2.33 were released on July 30, 2026, as security releases. They fix SQL injection via E'...' backslash breakout in the PostgreSQL extension (CVE-2026-17543), upgrade the bundled libgd image library (CVE-2026-9672) and fix a crash via recursive symlinks in Phar (CVE-2026-7260). PHP 8.5.9 and 8.4.24 also fix an out of bounds write in bccomp() in BCMath (CVE-2026-17544). They followed the July 2 security releases (8.5.8, 8.4.23, 8.3.32 and 8.2.32), which fixed memory corruption in openssl_encrypt() with AES-WRAP-PAD (CVE-2026-14355).
What it means for you
Servers that skipped the July 2 update should go straight to the latest release for their branch. The PostgreSQL fix does not touch a standard WordPress database, which runs on MySQL or MariaDB, but it matters for reporting tools and custom apps on the same server. The libgd fix matters for any site that resizes images with GD.
How we use it in WordPress builds
We update PHP for every application on a server, not only WordPress. We check which image editor each site uses and test uploads, crops and thumbnails on staging. For stores and finance features built with BCMath, we rerun calculation tests to confirm totals match to the cent, and we review custom code that encrypts data with OpenSSL.
What it means for mobile apps
Image uploads and calculations behind an AppPresser app run on the same PHP server, so patching it protects the app's back end.
What to do next
- Ask your host to confirm the latest PHP release for your branch.
- Our WordPress security and hosting service covers server side patching.
MySQL July 2026 Critical Patch Update
What shipped
Oracle published its July 2026 Critical Patch Update on July 21, 2026. For MySQL it lists:
- 54 MySQL patches, 9 of them remotely exploitable without authentication, with 41 risk matrix rows affecting MySQL Server
- CVE-2026-60163 (CVSS 8.8) in the Group Replication plugin, affecting 8.4.0 to 8.4.10 and 9.7.0 to 9.7.1
- CVE-2026-60315 (CVSS 8.2), an X Plugin issue exploitable without authentication
- The fixed releases are MySQL 8.4.11 and 9.7.2
What it means for you
This is a large quarterly patch for the database behind WordPress. Sites on shared or managed hosting depend on the host to apply it.
How we use it in WordPress builds
On the hosting we manage, we apply database patches during a low traffic window after a fresh backup, then check that WordPress, WooCommerce orders and any custom tables read and write normally.
What it means for mobile apps
This is a server side change. It does not change how an AppPresser app is built, but your app reads its content and login sessions from your WordPress site, so the same patch protects the app's data too.
What to do next
- Confirm your server runs MySQL 8.4.11, 9.7.2 or later.
- If you run your own server, schedule the update after a backup.
- Our WordPress security and hosting plans include database patching.
MySQL 26.7.0 Starts Calendar Versioning and Adds Post Quantum TLS
What shipped
Oracle released MySQL 26.7.0 on July 28, 2026, along with 8.4.11 and 9.7.2:
- MySQL 26.7.0, 8.4.11 and 9.7.2 were released July 28, 2026.
- 26.7.0 is the first release with calendar versioning (YY.M.P) after the 9.7 LTS series.
- It adds post quantum TLS 1.3 support with OpenSSL 3.5 or later.
- Thread Pool is now available in the Community edition.
- Support for Enterprise Linux 7 was dropped in 26.7.0 and 8.4.11.
What it means for you
Version numbers now follow the calendar, so 26.7 means July 2026. Servers on Enterprise Linux 7 no longer get MySQL packages, even on the 8.4 LTS line.
How we use it in WordPress builds
We keep WordPress production databases on LTS lines (8.4 or 9.7), not innovation releases like 26.7. The EL7 change is the part that needs planning.
What it means for mobile apps
Apps never talk to MySQL directly, so the version scheme and EL7 change stay invisible to them as long as the WordPress API keeps answering.
What to do next
If your database server runs Enterprise Linux 7, plan an OS upgrade. Our WordPress security and hosting team can migrate it.
Angular security advisories
What shipped
The Angular team published these security advisories in this period:
- CVE-2026-69151 (high): XSS through event handler attributes in i18n
- CVE-2026-68945 (high): HttpTransferCache cache key ambiguity
- CVE-2026-69149 (high): SSR raw content serialization XSS
What it means for you
These flaws are in the Angular framework, not in WordPress. They matter if you run an Angular front end, an Ionic Angular app or server side rendering in front of WordPress.
How we use it in WordPress builds
On headless WordPress front ends built with Angular, we update the @angular packages to the fixed version for the project's major line and rerun rendering, login and form tests.
What it means for mobile apps
Ionic Angular apps ship Angular inside the app, so a fix for code that runs in the app needs a rebuild and a new store submission.
What to do next
- Update to the fixed Angular 22.0 release named in each advisory, or 21.2.19 or 20.3.27 or later.
- Ask our mobile app team to rebuild and resubmit an affected app.
Capacitor 8.5 for the iOS 27 UIScene requirement
What shipped
Ionic released Capacitor 8.5 on July 31, 2026. The announcement states:
- Capacitor 8.5 adopts the UIScene life cycle on iOS
- This is required because iOS 27 requires scenes for apps built with the latest SDK (Xcode 27)
- It is a breaking minor release, and it changes iOS only
- Migrate with npm i -D @capacitor/cli@latest, then npx cap migrate
- Published apps keep running, and builds made with Xcode 26 are not affected
What it means for you
Your app needs this change before you build it with Xcode 27. Apple raises the minimum SDK for uploads over time, as it did with the iOS 26 SDK in April 2026.
How we use it in WordPress builds
Your WordPress site does not change.
What it means for mobile apps
For AppPresser and Ionic apps, we run the Capacitor migration on a branch, test push notifications, deep links and app launch on iOS devices, then submit through our App Store submission process.
What to do next
- Check your Capacitor version
- Plan the Capacitor 8.5 migration before you move to Xcode 27
- Test push notifications and deep links after the migration
How AlphaWeb handles updates for you
We follow WordPress, WooCommerce, PHP and the major releases from xAI, Anthropic and OpenAI, test each update on staging and apply it on your schedule, security releases first. Our support and maintenance plans cover tested core, plugin and PHP updates.
We also track the server, app platform and payment releases behind your site and app, including MySQL, Angular, BuddyPress and Capacitor. Our WordPress security and hosting plans keep servers and databases patched, and our mobile app team handles SDK, policy and store changes for AppPresser and Ionic apps.
Frequently asked questions
Was my site updated automatically to WordPress 7.0.2?
Possibly, since WordPress.org forced updates. Sites with automatic updates disabled in code or blocked by file permissions may not have updated, so check the version.
Which WordPress versions were affected?
WordPress 7.0, 6.9 and 6.8. Versions before 6.8 were not affected. The fixes are in 7.0.2, 6.9.5 and 6.8.6.
Does the PostgreSQL fix affect WordPress?
Not a standard WordPress database, which runs on MySQL or MariaDB. It affects other applications on the server that use PostgreSQL.
Should production WordPress sites run MySQL 26.7?
We keep production on an LTS line, 8.4 or 9.7. 26.7 is the first calendar versioned release and is better tested on staging first.
I skipped the July 2 PHP update. What should I do?
Go straight to the latest release for your branch, which includes both sets of fixes.
Is the MySQL July 2026 update the same as MySQL 26.7?
No. The July Critical Patch Update fixes security issues in 8.4 and 9.7 through 8.4.11 and 9.7.2. MySQL 26.7.0 is the new calendar versioned release line.
Brief us on your mission
Want security releases checked and applied for you? Tell us about your site and a specialist will follow up.
