{"id":38525,"date":"2026-10-26T08:33:09","date_gmt":"2026-10-26T07:33:09","guid":{"rendered":"https:\/\/www.hdkn-solutions.com\/non-classe\/php2shell-vulnerabilities-your-websites-are-protected-and-still-monitored\/"},"modified":"2026-10-26T09:09:17","modified_gmt":"2026-10-26T08:09:17","slug":"php2shell-vulnerabilities-websites-protected","status":"publish","type":"post","link":"https:\/\/www.hdkn-solutions.com\/en\/news\/php2shell-vulnerabilities-websites-protected\/","title":{"rendered":"PHP2Shell vulnerabilities: your websites are protected and still monitored"},"content":{"rendered":"<div class=\"hx-brief\">\n<p class=\"hx-brief__t\">In short<\/p>\n<ul>\n<li>On October 20, 2026, two critical vulnerabilities were disclosed in PHP, the language that powers WordPress.<\/li>\n<li>Fixes were applied overnight from October 21 to 22. We then checked every website we manage, one by one: 100% of our portfolio is up to date, with no service interruption.<\/li>\n<li>Your websites remain under continuous monitoring. There&#8217;s nothing you need to do.<\/li>\n<\/ul>\n<\/div>\n<p>Last week, two critical security vulnerabilities were disclosed in PHP (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10. PHP is the language behind WordPress, WooCommerce and nearly 70% of websites worldwide, so the whole industry had a busy few days.<\/p>\n<p>Here&#8217;s a plain-language update.<\/p>\n<h2>What happened<\/h2>\n<p>On the evening of Tuesday, October 20, details about these flaws leaked ahead of schedule. In practical terms, they could let an attacker run code on a server without needing any password. Every PHP version in use was affected, at every hosting provider.<\/p>\n<h2>What we did<\/h2>\n<ul>\n<li>On Wednesday, October 21, the PHP team released the official fixes.<\/li>\n<li>Overnight, our hosting provider, Infomaniak, rolled them out across all of its servers.<\/li>\n<li>On Thursday and Friday, we checked every website we manage, one by one. The result: 100% of our portfolio now runs a patched version of PHP, including sites we launched years ago, without a single service interruption for our clients.<\/li>\n<\/ul>\n<p>This is where our size works in our favor. A small, hands-on agency knows every website it manages. No call center, no support tickets, no queue: as soon as the fix was released, we reviewed our entire portfolio ourselves, site by site.<\/p>\n<h2>Monitoring doesn&#8217;t stop there<\/h2>\n<p>Your websites are monitored around the clock: firewall, daily security scans and alerts whenever something looks unusual. We know this kind of event always happens sooner or later. That&#8217;s exactly why monitoring runs all the time, not just when the news heats up.<\/p>\n<p>Proof that the topic is never fully closed: on October 23, the PHP team reported a third, much less serious vulnerability. It only affects very unusual configurations and will be fixed in PHP&#8217;s next regular update. We&#8217;re tracking it like everything else.<\/p>\n<h2>What&#8217;s next?<\/h2>\n<p>We&#8217;re using this episode to speed up some long-term work: gradually moving the oldest environments to the latest PHP versions and to our hosting provider&#8217;s new infrastructure. A website isn&#8217;t a one-time project, it needs upkeep, and that&#8217;s the whole point of our <a href=\"https:\/\/www.hdkn-solutions.com\/en\/website-maintenance-montreal\/\">maintenance plan<\/a>. If any of this work means your site will be unavailable for a few moments, we&#8217;ll let you know beforehand.<\/p>\n<h2>Anything you need to do?<\/h2>\n<p>No. If you have any questions about your website or hosting, <a href=\"https:\/\/www.hdkn-solutions.com\/en\/contact\/\">write to us<\/a> and we&#8217;ll take the time to answer.<\/p>\n<p><em>William, founder of HDKN<\/em><\/p>\n<h2>Sources<\/h2>\n<ul class=\"hx-sources\">\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-21-5\" target=\"_blank\" rel=\"noopener\">PHP, security advisory on the critical vulnerabilities, October 21, 2026<\/a><\/li>\n<li><a href=\"https:\/\/www.php.net\/archive\/2026.php#2026-10-23-1\" target=\"_blank\" rel=\"noopener\">PHP, advisory on the third vulnerability (CVE-2026-115560), October 23, 2026<\/a><\/li>\n<li><a href=\"https:\/\/cert.europa.eu\/publications\/security-advisories\/2026-018\/\" target=\"_blank\" rel=\"noopener\">CERT-EU, security advisory 2026-018<\/a><\/li>\n<li><a href=\"https:\/\/infomaniakstatus.com\/p7jX3ML9E1\/\" target=\"_blank\" rel=\"noopener\">Infomaniak, PHP security measures status page<\/a><\/li>\n<li><a href=\"https:\/\/w3techs.com\/technologies\/details\/pl-php\" target=\"_blank\" rel=\"noopener\">W3Techs, share of websites using PHP (October 2026)<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Two critical vulnerabilities hit PHP last week. Here&#8217;s what we did for the websites we manage, and what comes next.<\/p>\n","protected":false},"author":1,"featured_media":38524,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_titles_title":"PHP2Shell: your websites are protected | HDKN","_seopress_titles_desc":"Two critical PHP vulnerabilities surfaced in October 2026. Fixes applied, every site checked one by one and continuous monitoring: our full update.","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"footnotes":""},"categories":[85],"tags":[],"class_list":["post-38525","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/posts\/38525","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/comments?post=38525"}],"version-history":[{"count":2,"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/posts\/38525\/revisions"}],"predecessor-version":[{"id":38533,"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/posts\/38525\/revisions\/38533"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/media\/38524"}],"wp:attachment":[{"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/media?parent=38525"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/categories?post=38525"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hdkn-solutions.com\/en\/wp-json\/wp\/v2\/tags?post=38525"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}