If your website is built with WordPress, you may have recently received a notice from your hosting company, or seen news about a "critical PHP vulnerability". This article explains in plain language what happened, what it means for website owners, which websites need attention, and why C Building sites are not affected this time.
What happened?
PHP is a programming language used to build websites. WordPress, Drupal, Joomla, Magento and many sites that agencies build for their clients all run on PHP: every time someone opens a page, PHP runs on the server and builds that page.
On October 21, 2026, PHP released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the security community calls PHP2Shell.
In plain terms: an attacker doesn't need your website's username or password. By sending a specially crafted request to your site, they may be able to run their own code on your server. It's like someone walking through your shop's front door without a key.
How serious is it?
- Severity score of 9.2 (out of 10): rated "critical".
- It has nothing to do with which plugins you installed: the problem is in PHP itself. Security company Patchstack notes that even a page with a single line of "Hello World" can be attacked if its PHP version is vulnerable.
- It affects a huge number of sites: almost every PHP version from 5.4 onwards is affected. When Palo Alto Networks published its analysis, it detected more than 22.6 million potentially affected servers on the internet.
- It is already being exploited: on October 26, the US Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities catalog and advised taking systems offline if they cannot be updated right away.
What it means for website owners
Once an attacker can run code on your server, common consequences include:
- A "backdoor" is planted on your site so they can come back any time
- Your site is changed to redirect visitors to scam or gambling sites
- Customer and member data collected through your forms is leaked
- Your server is used to send spam or mine cryptocurrency, and your host suspends your account
- Google marks your site as "dangerous", hurting both your search ranking and your customers' trust
The worst part: a hacked site can look completely normal, and by the time you notice, weeks may have passed.
Which websites need attention?
Any website that runs PHP on its server should check that PHP has been updated. Common cases:
Watch out especially for two situations:
- PHP 8.1 or older: the patched versions PHP released are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions before 8.1 are no longer officially supported, and CISA advises taking such systems offline until they are updated. If your host still runs an old version, it's time to upgrade.
- WordPress itself also has a vulnerability: in the same month, WordPress core had a separate vulnerability (CVE-2026-87902) that, under certain conditions, may also let attackers run code, and it is already being exploited. Update WordPress to 7.1.2 or later.
If your website uses PHP, what you can do now
- Ask your host or developer: "Has our PHP been updated to a patched version?" Ask them for the exact version number.
- Update WordPress to 7.1.2 or later, along with your plugins and themes.
- Still on PHP 8.1 or older? Check with your host whether it has been patched; if not, plan an upgrade.
- Look for anything unusual on your site: admin accounts you don't recognize, a changed home page, or a Google dangerous-site warning.
- Change important passwords: if you suspect your site was hacked, change the passwords for your site's admin, your hosting and your database.
- Don't install "patch plugins" from unknown sources: the only complete fix is updating PHP; the setting tweaks going around online only reduce the risk.
Why aren't C Building sites affected?
1. A published site is made of ready-made web pages
When you press "Publish" in C Building, the platform turns every page into a complete web page file in advance. When visitors open your site, the server simply sends those ready-made files. It doesn't run PHP, and it doesn't run any of the site's own code. However many crafted requests an attacker sends, there is no code for them to exploit.
To see what the platform does when you publish, read What happens after you press "Publish"?
2. The platform doesn't use PHP at all
Features that need a server, such as receiving form submissions and the article system, are provided centrally by the C Building platform, built with Java and TypeScript, with no PHP.
3. Editing happens separately from the live site
When you edit your site in the editor, or the website AI writes code for you, the work happens in a cloud editing environment of its own for each website, separate from the live site your visitors see.
4. Updates are the platform's job, not yours
You don't need to know which versions your site uses or when to update. We take care of updating the server software; you don't have to upgrade anything or install plugins.
To be honest: no PHP doesn't mean no security issues ever
Any software can have vulnerabilities, including the software C Building uses. The difference is:
- Fewer places to attack: the live site only sends ready-made web page files; it doesn't run code every time someone visits.
- Fixes are handled centrally by the platform: when there is a vulnerability, we update once and every site is protected together, without waiting for each owner to act.
- If something goes wrong, it can be recovered: platform data is backed up and encrypted every day, and every publish of your site is recorded, so you can go back to an earlier version (see No worries if you break something).
Frequently asked questions
I use WordPress. Do I need to move right away?
No need to rush. First, have your host or developer update PHP and WordPress; that matters most. If you find you're always worrying about updates, plugins and security and don't want to deal with them anymore, then consider switching to a setup where the platform handles maintenance. C Building can bring your WordPress site over.
My site is on a platform like Wix or Shopify. Do I need to do anything?
With services like these, where the platform manages the servers, the platform is responsible for server updates, and regular users don't need to update PHP themselves. If you want peace of mind, check whether your platform has posted an announcement about it.
C Building sites have forms. Don't forms need a server?
They do. Form submissions are handled by the C Building platform, not by code on your site. We maintain and update the platform centrally, and it doesn't use PHP.
How do I know whether my site uses PHP?
If your site runs on WordPress, Drupal or Joomla, or sits on ordinary shared hosting, it almost certainly uses PHP. If you're not sure, the quickest way is to ask whoever built your site or your hosting company.
The bottom line
PHP2Shell is one of the most far-reaching website vulnerabilities in recent years, because it doesn't care which site it is and doesn't need a password: if PHP isn't updated, the site is at risk. If your website uses PHP, ask your host or developer to check the version today.
If you'd rather not worry about this kind of thing anymore, here is how C Building works: your site is published as ready-made web pages, the platform takes care of server updates, and you can focus on running your business.
Sources
- US Cybersecurity and Infrastructure Security Agency (CISA): Critical Vulnerabilities in PHP Require Immediate Patching (published October 21, 2026, updated October 26)
- Patchstack: Major security alert: PHP vulnerable to critical RCE
- Palo Alto Networks Unit 42: Threat Brief: CVE-2026-109618, CVE-2026-109619
- SiteGround: Critical PHP vulnerabilities: SiteGround sites protected
- CIS: A Vulnerability in WordPress Could Allow for Remote Code Execution (CVE-2026-87902)
Information checked on October 27, 2026. Security situations change quickly; rely on the latest announcements from PHP and your hosting company.