The php2shell PHP vulnerability: what happened, and why Squarespace is worth a look.

PHP is the programming language behind a huge share of the web. WordPress, WooCommerce, Drupal, Joomla and countless plugins and hosting control panels run on it. If you have a self-hosted website, there's a good chance PHP is working behind the scenes, even if you've never heard of it.

Because it's everywhere, a serious PHP flaw affects far more than one product. European agencies noted that many tools rely on PHP in the background, so some businesses are exposed without realizing it.

On October 21, 2026, the PHP project released fixes for two critical vulnerabilities that, under the right conditions, let an unauthenticated attacker run code on a server. In plain terms: a stranger on the internet could take control of your website's server without a password.

According to CISA, the flaws affect PHP installations that serve web pages, including Apache with mod_php (the highest-risk setup), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. That covers most common hosting setups.

Both bugs come from the way PHP cleans up after handling a visitor's request.

1. Running out of memory at the worst moment

PHP limits how much memory each request can use. The first advisory shows that a specially built form upload could push PHP past that limit while it was still setting things up. PHP would stop abruptly and leave half-built data behind, then treat it as valid. On Apache with mod_php, this could happen before your website's own code even ran, with default settings.

2. Leftovers from the previous visitor

The second advisory describes "stale" data. When an error interrupted one request, PHP could forget to clear some internal notes. The next request handled by the same server process could then read memory that had already been thrown away. An attacker who arranges that memory carefully can turn it into full control.

Neither bug was caused by a website owner doing something wrong. They lived deep inside PHP itself, which is exactly why they're so widespread.

1. Oct 20, 2026

   PHP announces an upcoming security release for two critical vulnerabilities.

2. Oct 21, 2026

   Fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. EU cybersecurity agencies issue a joint warning.

3. Oct 23, 2026

   A third, lower-risk issue affecting unusual setups is disclosed. Proof-of-concept attack code is circulating.

4. Oct 26, 2026

   CISA adds both vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming real-world attacks.

Sources: CERT-EU, CISA, ENISA.

• Ask your host which PHP version your site runs and whether it is patched.
• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later.
• If you are on PHP 8.1 or earlier, plan an upgrade now. Those versions no longer get fixes.
• Check other tools that may include PHP quietly, like control panels, forums or old landing pages.
• Turn on a web application firewall as a stopgap, not a fix.
• Watch for warning signs: unknown admin users, new files, unexpected redirects or a hosting suspension notice.

CISA's guidance is blunt: systems that can't be patched should be taken offline until they are.

php2shell is a reminder of a quiet trade-off. When you run a self-hosted site, someone has to keep the server, the PHP version, the content system, every plugin and every theme up to date. For many small and mid-sized businesses, that someone is a busy marketing person, a freelancer who moved on, or nobody at all.

Old PHP versions, abandoned plugins and forgotten staging sites are where attacks usually land. The fix for this month's bug is simple. Remembering to apply every fix, every month, for years, is not.

Squarespace is a fully hosted, managed platform. Instead of renting a server and maintaining software on it, you build on a platform whose own team handles the infrastructure. For a typical business website, that changes a lot:

• No server or PHP to patch. You never pick, install or upgrade a language version.
• No plugin sprawl. Core features are built in, so there's no pile of third-party add-ons to keep current.
• SSL and updates included. Security certificates and platform updates come with your plan.
• More time for marketing. Your team spends its hours on content and leads, not maintenance.

To be fair, no platform is risk-free, and Squarespace isn't the right fit for everyone. You give up server access and some of the deep customization a self-hosted site allows. Account security, like strong passwords and two-factor login, is still your job. But for most marketing sites, the trade is worth it.

Square Migration started in 2021 doing exactly this: moving businesses from WordPress, Wix, Webflow and others onto Squarespace. We map every old URL with 301 redirects, carry over your content and SEO settings, and resubmit your sitemap so Google picks up the new site cleanly.

See how our Squarespace migrations work or explore our Squarespace website services.