platformOS and every application running on it are not affected by the critical PHP vulnerabilities disclosed on October 21, 2026. platformOS does not run PHP, so there is nothing for our clients to patch, and no sites need to come offline.

On Wednesday, the PHP project released emergency updates for two flaws, CVE-2026-109618 and CVE-2026-109619, which researchers have nicknamed "PHP2Shell." Both let an attacker run code on a server with a single crafted web request, without logging in. PHP rates them 9.2 (critical), and attempted exploitation is already being reported.

What you need to do

If you run on platformOS: NOTHING. Your applications are not affected. No patching, no downtime, no action required.

If you don't run on platformOS: it's time to think about moving to us, and we are here to help. Sites on WordPress, Drupal, Joomla and other PHP platforms face emergency patching this week, possible downtime, and the work of confirming nothing was compromised. It will not be the last time.

Built for the AI era. AI helped find these flaws, and AI will help attackers turn patches into exploits faster than ever. platformOS is AI augmented, with MCP (Model Context Protocol) frameworks already in place, so AI tools and agents work with your application through the same secure, sandboxed layers described below rather than through raw server access.

Who is affected

Any website or application built on PHP is potentially exposed. That includes WordPress, Drupal, Joomla, Magento and the many custom applications and plugins built on them. Roughly 70% of websites run on PHP.

• Scale: estimates of vulnerable sites range from 1.3 million to more than 22.6 million exposed instances.
• Hard to patch: the fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Cisco estimates about half of internet-facing PHP installs are too old to receive them.
• Government response: CISA and its counterparts in the UK, Canada, Australia and the EU urged operators to take sites offline until patched. The government of Finland and the Dutch House of Representatives did exactly that.

If you run any other PHP-based sites, update PHP now and follow your host's guidance.

Why platformOS is not affected

This is not luck. platformOS was designed so that a flaw in a general-purpose language runtime cannot reach your application.

• No PHP anywhere in the stack. The vulnerable code simply is not present.
• Liquid instead of a general-purpose language. Business logic runs in Liquid, a sandboxed language that only executes explicitly allowed operations. Developers cannot run arbitrary server code, which is exactly what PHP2Shell exploits.
• GraphQL as the only path to data. Applications never touch the database directly, and static analysis guards against SQL injection.
• Managed infrastructure. Runtime, database, caching and search are run and patched by our DevOps and SecOps team, not by each client. When an industry-wide issue does land, we fix it once for every instance.

These abstraction layers exist to shrink the attack surface. Events like this week's are the reason we built them.

Security you can verify

platformOS has completed its readiness program for SOC 2 Type I and Type II and ISO 27001, with all controls in place. Formal certification is pending the independent audit.

That means documented, tested processes for access control, change management, vulnerability management and incident response, the same disciplines that keep issues like PHP2Shell away from your applications.

Further reading

• Critical PHP vulnerabilities expose most websites to potential compromise (Cybersecurity Dive)
• CISA alert: critical vulnerabilities in PHP require immediate patching
• Wiz research: PHP2Shell
• PHP 8.5.12 security release notes
• Why platformOS uses Liquid, GraphQL and YAML
• platformOS security FAQ