Getting hacked is bad enough. You shouldn't have to pay another bill to clean up your site. Security should be part of what you're already paying your host to do.
Two critical PHP vulnerabilities were disclosed on October 21, 2026. WordPress.com sites are already protected, with no action required from site owners.