10/21/2026
A critical PHP vulnerability, tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), is putting a lot of websites at risk. Here's where we stand.
We take security seriously. We keep the servers we run up to date, and we use Cloudflare's WAF as an added layer that blocks exploit attempts before they reach our clients' sites.
Patching and layered defenses work together. Updating PHP is the permanent fix, and a WAF adds protection while updates roll out.
If your site runs PHP on infrastructure someone else manages, it's a good time to ask whether it's been updated. Want to talk through your own setup? We're happy to help:
