If Posted Social manages your website, this didn’t affect you. Your site is patched and stayed online, with no evidence of compromise. You don’t need to take any action.
What is PHP2Shell?
PHP is the programming language behind WordPress and much of the web. PHP2Shell refers to two flaws in PHP itself—not in WordPress, a theme, or a plugin:
- CVE-2026-109618: An attacker sends an oversized or malformed request that corrupts the server’s memory, then uses that corruption to execute their own code.
- CVE-2026-109619: An attacker abuses leftover data and a caching component (OPcache) to do the same thing.
Both have a severity rating of 9.2 out of 10. The attacker needs neither a password nor access to the site. Updating WordPress won’t fix the vulnerabilities; the server’s PHP version must be upgraded.
How big was this?
PHP released fixes on October 21. Within hours:
- The NSA issued an advisory urging US government agencies to patch immediately. It also recommended temporarily taking systems offline if they couldn’t patch them immediately.
- Governments across Europe took websites offline as a precaution, including sites in Germany, France, Belgium, the Netherlands, Finland, and the Czech Republic.
- Major organizations suspended services, including parts of the BBC, the Internet Archive, Wikimedia, and several Japanese banks, airlines, and government agencies.
What happened to our clients’ sites?
Nothing—and that’s the point. Every site we manage runs on a top-tier managed hosting platform that makes security a core priority. Once the fixes were released, the platform deployed PHP security updates across all our sites and found no evidence of compromise. While other organizations were deciding whether to go dark, our clients’ sites kept running.
What you need to do
Nothing. This is part of what you get when you work with us. If you have a site we don’t manage, ask your host whether it’s been patched. Sites on PHP 7.3 or older receive no fix at all. We’re happy to check it for you.
Why this matters
Part of our work is choosing the infrastructure your site runs on. Most businesses learned about PHP2Shell from the news. We didn’t have to. No one can promise the internet will stop producing vulnerabilities, but we can promise that when one appears, your site is in good hands.