What happened
On 21 October 2026, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively nicknamed 'PHP2Shell'. Both were rated 9.2 out of 10 for severity and could let an attacker run code on a web server without ever logging in.
Crucially, the flaws sit inside PHP itself rather than in any website's own code. That means every PHP site serving web requests was potentially exposed – whether it's built on Drupal, WordPress or something bespoke. Details had leaked online the day before the fix landed, and the UK's National Cyber Security Centre was quick to urge organisations to act immediately.
For the charity, education, healthcare and membership organisations we support, that's exactly the kind of headline that causes a sleepless night. So here's how we handled it – and why our support clients didn't need to lift a finger.
1. Working hand in hand with Pantheon and Upsun
The sites on our support service are hosted with two specialist partners, Pantheon and Upsun. One of the big advantages of managed hosting like this is that PHP is maintained at the platform level – so when a fix is released, it can be rolled out across every site in a coordinated way, rather than server by server.
As soon as the patched releases landed, we were in contact with both teams to agree a rollout plan. Pantheon and Upsun took care of updating the PHP runtime across their platforms, while our team worked through every site on our support service to confirm it was running a patched version.
2. Keeping sites secure while the rollout was underway
A platform-wide update doesn't happen in an instant, and with exploit code circulating publicly, we weren't prepared to leave any window open in the meantime. While the rollout was in progress, temporary mitigations were applied across both platforms to reduce the risk of a successful attack.
3. No action needed from our clients
Because the fix lived in the PHP runtime rather than in each website's code, there was nothing for our clients to approve, test or schedule. No content freezes, no code deployments and no interruption to the people using their sites.
That's very much how we think support should work. Our clients are busy delivering vital services, raising funds and supporting their communities.
4. Keeping everyone in the loop
No action needed doesn't mean no communication. When a vulnerability makes the news, our clients deserve to hear from us before they start wondering.
Our support desk contacted clients on our support service to explain what the plan to secure against PHP2Shell was, how it could affect them, and what we were doing about it.
And if anyone had questions along the way, they knew exactly who to ask.
Looking ahead
PHP2Shell is unlikely to be a one-off. The researchers behind it used AI to help uncover and demonstrate the flaws, and they've noted that AI models are dramatically lowering the barrier to turning long-hidden bugs into working exploits. The same tools that help the good guys find vulnerabilities faster are helping attackers too – and we're already seeing critical issues like this emerge more often, with less time between disclosure and exploitation.
That makes keeping websites and the infrastructure underneath them up to date more important than ever. It's no longer something that can wait for the next redesign or a quiet week. Our support service is built to take that weight off your shoulders: for Drupal and WordPress site owners, we handle core, module and plugin updates, monitor for security advisories, and work with hosting partners like Pantheon and Upsun so that when the next critical vulnerability arrives, you're already covered.
