26 October 2026
News

PHP2Shell vulnerabilities: your websites are protected and still monitored

In short

On October 20, 2026, two critical vulnerabilities were disclosed in PHP, the language that powers WordPress.
Fixes were applied overnight from October 21 to 22. We then checked every website we manage, one by one: 100% of our portfolio is up to date, with no service interruption.
Your websites remain under continuous monitoring. There’s nothing you need to do.

Last week, two critical security vulnerabilities were disclosed in PHP (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10. PHP is the language behind WordPress, WooCommerce and nearly 70% of websites worldwide, so the whole industry had a busy few days.

Here’s a plain-language update.

What happened

On the evening of Tuesday, October 20, details about these flaws leaked ahead of schedule. In practical terms, they could let an attacker run code on a server without needing any password. Every PHP version in use was affected, at every hosting provider.

What we did

On Wednesday, October 21, the PHP team released the official fixes.
Overnight, our hosting provider, Infomaniak, rolled them out across all of its servers.
On Thursday and Friday, we checked every website we manage, one by one. The result: 100% of our portfolio now runs a patched version of PHP, including sites we launched years ago, without a single service interruption for our clients.

This is where our size works in our favor. A small, hands-on agency knows every website it manages. No call center, no support tickets, no queue: as soon as the fix was released, we reviewed our entire portfolio ourselves, site by site.

Monitoring doesn’t stop there

Your websites are monitored around the clock: firewall, daily security scans and alerts whenever something looks unusual. We know this kind of event always happens sooner or later. That’s exactly why monitoring runs all the time, not just when the news heats up.

Proof that the topic is never fully closed: on October 23, the PHP team reported a third, much less serious vulnerability. It only affects very unusual configurations and will be fixed in PHP’s next regular update. We’re tracking it like everything else.

What’s next?

We’re using this episode to speed up some long-term work: gradually moving the oldest environments to the latest PHP versions and to our hosting provider’s new infrastructure. A website isn’t a one-time project, it needs upkeep, and that’s the whole point of our maintenance plan. If any of this work means your site will be unavailable for a few moments, we’ll let you know beforehand.