Summary: safacloud.co.uk does not run PHP. Our site is built with Next.js 15 and served from Firebase Hosting, so the PHP2Shell vulnerabilities do not apply to it.
What happened
On 21 October 2026, two critical vulnerabilities in PHP were disclosed and patched as CVE-2026-109618 and CVE-2026-109619. The pair, widely referred to as PHP2Shell, allows unauthenticated remote code execution: an attacker can run commands on a vulnerable server without a username or password. A third related flaw, CVE-2026-115560, was identified shortly afterwards.
PHP underpins a large share of the web, including WordPress, Drupal, Magento and MediaWiki. Exploitation attempts rose from thousands to millions within hours, and the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaws to its Known Exploited Vulnerabilities catalog on 26 October 2026. Several governments temporarily took services offline while they patched.
Why our website is not affected
- safacloud.co.uk is built with Next.js 15 and React. Its pages are compiled to static HTML, CSS and JavaScript and served from Firebase Hosting's global content delivery network.
- There is no PHP interpreter, no WordPress, Drupal, Magento or MediaWiki installation, and no PHP plugin or theme anywhere in the site's stack.
- The vulnerability affects servers running an unpatched PHP runtime. Because our site never executes PHP, visitors and customers do not need to take any action because of it.
- We reviewed the build and hosting configuration after the disclosure and found no PHP dependency.
If you run PHP elsewhere, check it now
Most organisations still run PHP somewhere — often a WordPress marketing site, a legacy intranet application, or a site managed by an agency. This disclosure is a prompt to verify, not a reason to panic.
- Inventory every PHP-based site and application you operate, including those hosted by third parties.
- Apply the vendor patches and move off end-of-life branches. PHP 8.1 and earlier no longer receive security support.
- Put a web application firewall in front of internet-facing PHP applications. Several providers released virtual patching while patches were rolled out.
- Review logs for unexpected POST requests, new administrator accounts and webshell files, and rotate credentials if you find signs of compromise.
- Ask your hosting provider or agency for written confirmation that each site runs a supported, patched PHP version.
Our position
SafaCloud's own website is not exposed to PHP2Shell. We are monitoring the incident and will update this article if anything changes. If you would like help reviewing a PHP estate or planning a move to a maintained platform, contact our team.