Siteglide Spotlight

On Wednesday 21 October 2026 the PHP project shipped emergency security updates for two critical flaws now known as PHP2Shell. If you run websites, you have probably had at least one worried client message already. Here's what happened, and why Siteglide is not affected by this issue.

What PHP2Shell means for the web

The two vulnerabilities are CVE-2026-109618 and CVE-2026-109619. The PHP project rates both 9.2 out of 10 (critical) under CVSS v4.0, and both can allow unauthenticated remote code execution. That means an attacker can run code on your server without logging in.

CVE-2026-109618 occurs when a request runs out of memory at the wrong moment. PHP can leave partially initialised internal data behind and treat it as valid during cleanup, corrupting memory. CVE-2026-109619 happens when a fatal error leaves internal state pointing at memory that has already been freed, and a later request handled by the same worker can use it.

The PHP project says all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It considers mod_php the highest risk, with a demonstrated exploit where one unauthenticated request triggers the attack before any application code runs.

The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older receive no official updates, though the PHP project published minimal source backports for 7.4, 8.0 and 8.1, and Linux distributions and long-term support vendors may have their own. The PHP project is clear that updating is the only complete fix; configuration workarounds only reduce exposure.

Is it being exploited? Amazon Threat Intelligence saw a first attempt on 17 October, four days before disclosure, and says PHP2Shell is now being broadly exploited in the wild. Cloudflare reported attack traffic before the fix shipped. CISA said it had not observed exploitation when it published its alert on 21 October, and at the time of writing neither CVE is on CISA's Known Exploited Vulnerabilities list. No confirmed breach has been publicly reported.

You can read the official PHP security advisory, the technical advisory on GitHub and the CISA alert.

PHP powers a large share of the web, including WordPress, Joomla and Drupal sites. If you run PHP sites, this matters.

Siteglide doesn't run on PHP

Siteglide sites are not built in PHP. There is no PHP runtime for agencies to install, host or patch. That means Siteglide is not affected by PHP2Shell, or by PHP-runtime vulnerabilities like it.

This isn't luck. It's architecture.

What Siteglide is built on instead

Siteglide is built on platformOS, a managed platform as a service. Sites are built with:

• Liquid for server-side rendering and logic (the templating language originally from Shopify)
• GraphQL to query and change data
• YAML for settings

platformOS uses Liquid mainly for security, it runs in a sandbox-like environment where only explicitly allowed operations execute, unlike general-purpose languages such as PHP, Python and Java.

There is no self-hosted PHP stack, and no plugin ecosystem for agencies to keep patching.

Why this architecture matters for security

When you build on a traditional self-hosted CMS, you're responsible for the runtime, the server, the patches, the plugins and the stack. You carry the security burden. When a critical vulnerability drops on a Wednesday, you patch or you're exposed.

With Siteglide, the platform handles the runtime and the infrastructure. You build sites. You don't maintain servers, you don't patch PHP and you don't chase plugin updates. You sidestep the whole class of runtime-level risk that PHP2Shell represents.

That's the hybrid model: agencies get control over the front end, the logic and the data, without becoming responsible for the platform layer underneath.

This isn't about PHP being bad. PHP powers a huge portion of the web, and plenty of good platforms run on it. It's about where the responsibility sits. If you're an agency, your job is to build great sites for clients, not to become a server administrator.

Where Siteglide stands

Siteglide is not affected by PHP2Shell, and we have no known vulnerabilities related to it. You don't need to take any action on your Siteglide sites because of this issue.

We won't claim we'll never have a security issue. No platform can promise that. What we can say is that this class of PHP-runtime vulnerability doesn't apply to how Siteglide is built, because security, maintenance and infrastructure are managed at the platform level rather than pushed onto agencies.

If you run PHP sites, patch now

If you're running PHP sites, whether WordPress, Drupal, Joomla or custom builds:

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now, or install your distribution's or host's patched packages.
• If you're on PHP 8.1 or older, check whether your distribution or LTS vendor has a backport, or upgrade to a supported version.
• Prioritise internet-facing sites, and check logs for signs of compromise from at least 17 October.
• Don't rely on configuration workarounds. Updating is the only complete fix.

This is the reality of managing your own stack. When a critical vulnerability drops, the clock starts ticking.