You may have heard about the critical PHP security vulnerabilities, collectively known as PHP2Shell, which were publicly disclosed on 21 October 2026.
Given that PHP powers millions of websites worldwide, including WordPress, the news has understandably raised concerns among website owners.
The good news? If your website is hosted with CRJ Design, the necessary security patches have already been applied automatically. There’s nothing you need to do.
What is PHP2Shell?
PHP2Shell refers to two critical security vulnerabilities discovered in PHP, the programming language used to power WordPress and many other websites.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, relate to how PHP handles memory. Under certain circumstances, attackers could potentially exploit these weaknesses to execute malicious code on affected servers.
Both vulnerabilities have been classified as critical, with severity scores of 9.2 out of 10.
Unlike vulnerabilities affecting individual WordPress plugins or themes, PHP2Shell affects the underlying PHP software running on web servers. This means that even websites with fully updated WordPress installations could potentially be affected if their hosting environment hadn’t been patched.
What has been done to protect CRJ Design websites?
All websites hosted by CRJ Design benefit from our managed hosting infrastructure, supported by our hosting provider.
Following the disclosure of PHP2Shell on 21 October, our hosting provider’s systems team responded promptly, introducing additional security measures and deploying the necessary PHP security patches across its infrastructure.
Importantly, these updates were handled automatically at server level, meaning no action was required from individual website owners.
Timeline of the security response
Our hosting provider published regular updates through its system status service throughout 21 October 2026.
- 15:24 BST: The vulnerabilities were acknowledged, with additional security measures already implemented. Work began on deploying the latest PHP security patches.
- 17:37 BST: The systems team confirmed that upstream security patches had been applied and deployment of updated PHP versions was underway.
- 18:30 BST: The rollout to the standard hosting platform was complete, including security fixes backported to older PHP versions. Cloud Server updates were continuing.
- 19:51 BST: The latest patched PHP versions were available across all Cloud Servers, with backported fixes for older versions being deployed.
- 21:01 BST: All Cloud Servers had been successfully updated, completing the deployment across the entire hosting platform.
By 9:01pm on 21 October 2026, our hosting provider confirmed that all PHP versions across its managed hosting platforms had been patched against the newly disclosed vulnerabilities.
Do I need to update my website or PHP version?
No additional action is required specifically for PHP2Shell if your website is hosted with CRJ Design.
We’ve received direct confirmation from our hosting provider that the necessary security patches have been deployed across all managed hosting platforms, including shared hosting and Managed Cloud Servers.
The fixes have also been backported to older PHP versions, so websites do not need to switch PHP versions specifically to receive protection against these vulnerabilities.
Of course, keeping WordPress, plugins, themes and PHP versions up to date remains an important part of maintaining a secure website. Backported fixes address these particular vulnerabilities but aren’t a substitute for ongoing software maintenance.
Has any customer data been compromised?
Our hosting provider’s published incident updates have not reported evidence of exploitation affecting its infrastructure.
However, it’s important to distinguish this from a guarantee that no individual website has been compromised. As with any security incident, unexpected website behaviour or suspicious files should always be investigated.
At present, we have no information suggesting that CRJ Design-hosted websites have been compromised as a result of PHP2Shell.
Importantly, our daily automatic malware scans have also come back clear for all websites hosted with us.
Keeping your website safe
Security is one of the reasons we place so much importance on reliable, managed website hosting.
By working with a hosting provider that actively monitors emerging threats and deploys server-level security updates, we can help protect our clients’ websites without requiring them to navigate complicated technical updates themselves.
If your website is hosted with CRJ Design, you can be reassured that the PHP2Shell security patches have been automatically applied.
We’ll continue to monitor security developments and work with our hosting provider to help keep your website safe, secure and running smoothly.
If you have any questions or concerns about your website’s security, please don’t hesitate to get in touch.