THINKING AHEAD

Insights from the frontier of branding, creativity, and AI.

Thinking Ahead is our editorial space to share what we’re learning, testing, and refining—so you can build brands that don’t just keep up, but lead.

Filters by Categories
Web Architecture DWHQ Web Architecture DWHQ

PHP2Shell: What the Biggest Web Vulnerability of 2026 Means for Your Business Website — and Why We Build on Squarespace

PHP2Shell is the name given to two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619) disclosed on 21 October 2026. They allow unauthenticated remote code execution on any unpatched web server running PHP, including most WordPress, Drupal and Magento sites. The only complete fix is upgrading to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor backport. Squarespace websites are not affected, because Squarespace is a fully managed platform that does not expose a PHP runtime to site owners. DWHQ, a Singapore branding consultancy and Squarespace Gold Partner, builds client websites exclusively on Squarespace so that server patching, runtime security and platform updates are handled centrally rather than by the business.

Key facts at a glance

  • Disclosed: 21 October 2026, with exploitation attempts recorded four days earlier

  • Severity: CVSS v4.0 score 9.2, unauthenticated remote code execution

  • Affected: nearly every PHP version since 5.4, across PHP-FPM, mod_php, LiteSpeed and FrankenPHP

  • Discovered by: Wiz Research, Calif and OpenAI’s Codex Security team, using AI-assisted code analysis

  • Squarespace sites: no action required

  • Action for PHP sites: confirm patched version with your host in writing; review logs from 15 October

Read More