PHP Security Vulnerability

Posted on 22nd October 2026

Nick Authour Blog image

Author - Nick - Developer - Toolkit Websites

Your website is not affected

You may have seen news this week about a serious security vulnerability affecting PHP, one of the most widely used programming languages on the web. We want to reassure you that your website is not affected.

What’s happened?

On the 21st October 2026, the PHP development team released emergency updates to fix two critical vulnerabilities, known collectively as “PHP2Shell”. These flaws could allow attackers to take control of web servers running PHP without needing a password. Because PHP powers popular platforms such as WordPress, Drupal, Joomla and Magento, a very large number of websites worldwide are affected, and owners of those sites are being urged to update immediately.

Why aren’t we affected?

Our websites are not built with PHP. Our platform and in-house CMS are built on Microsoft .NET, a completely separate technology. The PHP2Shell vulnerabilities exist only within PHP itself, so they cannot be used against sites built on .NET.

Do you need to do anything?

No. There’s no action needed on your part, and your website continues to run as normal.

Our ongoing commitment to security

Even when an issue doesn’t affect us, we keep a close eye on security news across the industry. We keep our platform and servers up to date, apply security patches promptly, and continually review how we protect your site and your visitors’ data.

If you have any questions or concerns, please don’t hesitate to get in touch with the team.

Back To Blog »