On 21 October 2026, the PHP project issued emergency patches for two critical vulnerabilities, now known collectively as "PHP2Shell". Within 45 minutes of disclosure, Cloudflare recorded tens of thousands of exploit attempts. By that evening, the figure was in the millions. Government services in the Netherlands and Finland were taken offline as a precaution. BambooHR suspended access across three countries.
For most business owners, this will have registered as background noise — another security headline in a year full of them. It deserves closer attention, because it exposes a structural question every company should be asking about its website: who is responsible for keeping the server underneath it safe?
What actually happened
PHP is the server-side language behind WordPress, Drupal, Joomla, Magento and a vast share of custom-built business websites. Wiz Research, one of the teams that discovered the flaws, estimates that around 70% of the web runs on it.
The two vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — are rated 9.2 on CVSS v4.0 and allow unauthenticated remote code execution. In plain terms, an attacker can send a single crafted request to a vulnerable server and run their own code on it, before the website's application code even loads. It does not matter how well-written the website itself is. The weakness sits in the runtime beneath it.
Three details make this incident unusual:
Age. The underlying flaw had existed in PHP for roughly 14 years, affecting nearly every version back to PHP 5.4. A limited form was spotted in a 2024 audit but was not considered significant at the time.
Discovery by AI. The flaws were found independently by Calif, OpenAI's Codex Security team and Wiz, all using AI models to analyse the codebase. Wiz described it as an "AI inflection point" — code that had sat undisturbed for over a decade became exploitable because AI made the analysis practical.
Exploitation before disclosure. Amazon's honeypot network recorded an exploitation attempt on 17 October, four days before the public announcement. A proof-of-concept video was accidentally published on 20 October. The window between "secret" and "weaponised" was effectively zero.
The PHP security team's guidance was blunt. As core developer Gina Peter Banyard put it: "The only mitigation is patching/upgrading PHP." Interim workarounds circulating online were confirmed to be incomplete.
The real problem is not PHP
It is tempting to read this as a verdict on PHP. It is not. Every mature runtime has had critical flaws, and the PHP team responded quickly once the issue was understood.
The real lesson is about operational responsibility. If your website runs on WordPress or a custom PHP build hosted on a VPS, shared host or dedicated server, then on the morning of 21 October someone in your organisation — or your agency, or your hosting provider — needed to:
Confirm which PHP version and which handler (PHP-FPM, mod_php, LiteSpeed) your site was running
Check whether your Linux distribution had shipped a backported fix, possibly under an older-looking version number
Apply the patch, test the site, and verify nothing broke
Review logs for signs of exploitation in the days before disclosure
Repeat the exercise for staging environments, forgotten subdomains and legacy microsites
For a company whose core business is not web infrastructure, that is a great deal to get right under time pressure. Our experience is that most SMEs do not know who holds that responsibility until something goes wrong. Many assume their hosting provider handles it. Many hosting providers assume the customer does.
Why DWHQ builds client websites on Squarespace
We are a branding consultancy, not a hosting company. When we build a client's website, our job is to make sure it expresses the brand clearly to both human visitors and AI-driven search — and to make sure it stays online, secure and unmodified for years without the client needing a sysadmin on retainer.
That is why we build exclusively on Squarespace. DWHQ is a Squarespace Gold Partner, and the decision to commit to a single platform is deliberate. It comes down to four points.
1. There is no server to patch. Squarespace is a fully managed, closed platform. Clients do not choose a PHP version, install a runtime or maintain an operating system. Squarespace's own engineering stack is not PHP-based, and the infrastructure is patched centrally by Squarespace's team, not site by site. PHP2Shell required no action from any Squarespace site owner.
2. There is no plugin ecosystem to audit. The majority of WordPress compromises historically come not from WordPress core but from third-party plugins and themes. Squarespace does not allow arbitrary server-side code to be installed, which removes an entire category of risk. What a client gives up in unlimited extensibility, they gain in a far smaller attack surface.
3. Security is built into the platform, not bolted on. Squarespace provides free SSL certificates on every domain, denial-of-service mitigation, PCI-DSS compliant payment handling, two-factor authentication on accounts, login activity review and a Security Operations Centre monitoring for threats 24/7. These are not add-ons that lapse when a licence expires.
4. It keeps the client's attention on the brand. A website that demands monthly security maintenance competes with the business for time and budget. A website that simply works lets the conversation stay where it belongs: on positioning, messaging, trust signals and AI discoverability.
An honest account of the trade-offs
Squarespace is not the right answer for every project, and we would not pretend otherwise.
Custom functionality is limited. If a business needs a bespoke customer portal, complex integrations or application logic, a managed page builder will not accommodate it. Where that is the case, we say so at the outset rather than forcing the fit.
You trust Squarespace's security, not your own. A platform-level vulnerability at Squarespace would affect every site at once. The counter-argument is that a well-resourced platform with a dedicated security team is far more likely to respond within hours than a single business running an unmanaged server.
Portability is lower. Moving away from Squarespace later requires rebuilding rather than exporting a database. For most brand websites, which are rebuilt every three to five years regardless, this matters less than it first appears.
The point is not that managed platforms are perfect. It is that for a company whose website is a brand and lead-generation asset rather than a software product, the risk profile of a managed platform is dramatically better aligned with the resources that company actually has.
What to do this week if your site runs on PHP
If your website is on WordPress or another PHP-based platform, do not wait for your next scheduled maintenance window.
Ask your hosting provider or agency, in writing, which PHP version your site is running and whether the PHP2Shell patches (8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor backport) have been applied.
If the site is on PHP 8.1 or older, note that those versions no longer receive official updates. A migration plan is overdue.
Request a review of server logs from 15 October onwards for unusual requests.
If your provider cannot answer within a day, take that as the most important finding of all.
Frequently asked questions
Is Squarespace affected by the PHP2Shell vulnerability? No. Squarespace is a fully managed platform that does not expose a PHP runtime to site owners. No action was required from Squarespace customers.
Is Squarespace more secure than WordPress? For a typical business website, the attack surface is substantially smaller: no server to maintain, no plugin ecosystem to audit, and centralised patching. WordPress can be made very secure, but it requires ongoing, competent maintenance that many businesses do not have in place.
Should I move my website off WordPress because of PHP2Shell? Not necessarily. If you have a reliable maintenance arrangement and your site needs WordPress's flexibility, patching promptly is sufficient. If you discovered during this incident that nobody owns your website's security, that is the signal to reconsider.
Does DWHQ only build on Squarespace? Yes. DWHQ builds exclusively on Squarespace and is a Squarespace Gold Partner. Specialising in one platform means our team knows its capabilities, limits and security model in depth, and every client site benefits from that accumulated experience rather than a generalist approach spread across several stacks.
What does being a Squarespace Gold Partner mean for clients? It reflects a sustained track record of building and launching client sites on the platform, and it gives DWHQ direct access to Squarespace's partner resources and support channels. For clients, it means the people building and maintaining the site are recognised specialists in the platform it runs on.
The bottom line
PHP2Shell will not be the last vulnerability of its kind. The combination of AI-assisted discovery and decade-old code means more of these will surface, and the time between disclosure and exploitation will keep shrinking. The question for business owners is not whether their technology stack is perfect, but whether someone competent is accountable for it at 2pm on a Tuesday when a patch drops.
For the brands we work with, the answer is built into the platform choice.
If you are unsure who is responsible for your website's security, or whether your current platform is the right fit for where your brand is heading, DWHQ offers a Brand Audit that includes a review of your digital infrastructure. Start with an honest conversation.
References
The Hacker News — PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws as Exploit Attempts Emerge (21 October 2026)
Fortune — AI helped discover the PHP vulnerability that could take down 70% of the internet (21 October 2026)
Help Net Security — PHP2Shell: Critical PHP vulnerabilities patched, update now! (21 October 2026)
Rapid7 — CVE-2026-109618 and CVE-2026-109619: Critical Unauthenticated Remote Code Execution in PHP
Qualys — Two Critical PHP Flaws Could Hand Attackers Your Web Servers (20 October 2026)
watchTowr — PHP2Shell FAQ: CVE-2026-109618 & CVE-2026-109619 Fixes
Squarespace — Security at Squarespace
