On 21 October 2026 a serious vulnerability known as PHP2Shell (CVE-2026-109618 / CVE-2026-109619) was announced in PHP. If your website runs on WordPress, Magento, Silverstripe or another content-managed platform, it is almost certainly built on PHP, so this affects a very large part of the web, not just the sites we host.

We know news like this can be worrying, so we want to explain clearly where things stand and what happens next.

What we are doing

As soon as the issue was announced, our team reviewed every website we look after. For each one we checked the server it runs on, its PHP version and the platform it is built on. From this, every site has been placed into one of four groups.

  1. Ready to patch

    The site already runs a current version of PHP. The security fix will be applied to the server as soon as it is released for our hosting platform. Where a site is with another hosting provider, we will work with that provider wherever possible.

  2. Update, then patch

    The site runs an older version of PHP. The platform (for example WordPress, Magento or Silverstripe) needs updating first so it can move to a current, patched version of PHP.

  3. Needs a longer-term plan

    The site is built on a much older platform that can't run on current PHP versions. These sites need a wider conversation about the best way forward.

  4. Being checked

    A very small number of sites need a closer look before we can confirm which group they belong in.

Next steps

We are monitoring the situation closely and waiting for the security patch to be released by our PHP provider.

If your site falls into groups 2, 3 or 4 and needs more than a server update, we will contact you directly to explain what's involved and agree next steps with you. If your site is in group 1, there's nothing you need to do; we'll apply the fix as soon as it's available.

Questions?

If you have any questions, or would like to know which group your site is in, our team is here to help. Just fill in the form below.

Not sure which group your site is in?

Get in touch and we'll let you know where your site stands.

Contact our team

Ask us about PHP2Shell

Leave your details and we'll come back to you, including which group your site is in.

We'll only use your details to reply to your enquiry.

Kind regards,
The Primal Space Team