Black October: Is Your Craft Website Safe?

October 2026 has been a particularly uncomfortable month for anyone responsible for keeping websites secure.

A succession of security advisories, newly disclosed vulnerabilities and urgent software updates has kept developers and hosting providers on their toes. For those of us working with PHP-powered websites, the most alarming development came on 21 October, when two critical PHP vulnerabilities, collectively dubbed PHP2Shell, were publicly disclosed.

The flaws raised the possibility of attackers executing malicious code on vulnerable servers, prompting an urgent response across the PHP community. And while PHP2Shell attracted much of the attention, it was part of a wider reminder that website security depends on far more than just keeping your content management system up to date.

For businesses running Craft CMS, the events of what we might reasonably call Black October highlight an important question: just how well protected is your website when the next major vulnerability emerges?

So What Happened?

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, involved flaws in how PHP handles memory during certain web requests. Under certain conditions, an attacker could potentially execute malicious code on a server without needing to log in to the website. That's about as serious as software vulnerabilities get.

The PHP development team released security updates on 21 October, covering the supported PHP 8.2, 8.3, 8.4 and 8.5 branches. For developers and hosting providers, the priority was to identify affected servers, install the relevant patches and confirm that websites were protected.

There was also a subsequent disclosure involving PHP's session upload-progress functionality (CVE-2026-115560), demonstrating how quickly the situation was evolving.

It's important to stress that the existence of a vulnerability doesn't automatically mean every PHP website has been compromised. Actual exposure depends on the server environment, PHP configuration and other factors.

Nevertheless, the potential consequences were serious enough to warrant immediate attention.

What Does This Have to do With Craft CMS?

Quite a lot, although not necessarily for the reason you might think.

Craft CMS is built using PHP. Every time someone visits a dynamic page or accesses the Craft Control Panel, PHP plays a fundamental role in processing the request.

But these particular vulnerabilities weren't flaws in Craft CMS. They existed deeper within the underlying PHP runtime. That distinction matters because updating Craft CMS alone wouldn't have resolved the problem.

A website could be running the latest version of Craft 5, with every plugin fully updated, and still be exposed if its server was running a vulnerable version of PHP.

This illustrates an important point that's easily overlooked: a website is made up of several interconnected layers of technology, and each needs appropriate maintenance.

How Craft Cloud Responded

Pixel & Tonic, the company behind Craft CMS, published an interesting article on 21 October explaining how it responded to the PHP2Shell vulnerabilities across its Craft Cloud hosting platform.

According to Pixel & Tonic, Cloudflare's emergency firewall protections helped protect Craft Cloud websites while the PHP patches were being prepared.

Once the updated PHP runtime images became available, the Craft Cloud team began deploying them across its infrastructure. Within a relatively short period, almost all Craft Cloud environments had been updated, with a small number of pre-existing build issues requiring additional attention.

Pixel & Tonic also reported no known successful attacks against Craft Cloud-hosted websites.

It's a great example of how a managed hosting platform can respond to a major security incident.

For businesses using other hosting arrangements, however, responsibility for applying those updates may sit with the hosting provider, server administrator, developer or some combination of the three.

And that's where things can become complicated.

Your Website is More Than Just Craft CMS

When I talk to clients about website maintenance, the conversation understandably tends to focus on Craft updates. Those are the updates they can see in the Control Panel, after all.

But a typical Craft website relies on considerably more than Craft itself.

There's the PHP runtime, database software, web server, operating system, Composer dependencies and any third-party plugins or integrations.

Some of these components are managed by the hosting provider. Others fall under the developer's responsibility. The important thing is that somebody knows who's responsible for what.

For example, keeping Craft and its plugins updated is something I routinely handle as part of maintaining and supporting a client's website. But PHP security updates may need to be applied at server level, sometimes by a separate hosting company.

During last week's incident, that distinction became particularly important.

Knowing who manages the server, whether security updates are applied automatically and how quickly critical patches can be deployed makes a considerable difference when something serious happens.

Why Running an Older Version of Craft is Another Risk

The PHP vulnerabilities also reinforce the importance of keeping Craft CMS itself within its supported lifecycle.

Craft 4, for example, reached the end of its security support in April 2026.

Although websites running Craft 4 may continue functioning perfectly well, they no longer receive official security fixes for newly discovered vulnerabilities in Craft itself.

The same principle applies to outdated plugins, unsupported PHP versions and ageing server software.

The longer a website remains on obsolete technology, the more difficult it can become to maintain securely.

And upgrading isn't always something that can be done overnight. A major Craft upgrade may involve changes to PHP requirements, plugins, custom modules and other dependencies. Leaving that work until an urgent security issue arises can make an already stressful situation considerably worse.

That's one reason I encourage clients to plan major upgrades well before their existing CMS reaches end of life.

Website Maintenance Should be Proactive, Not Reactive

One of the lessons from last week's events is that good website maintenance isn't just about installing updates when something breaks. It's about being prepared before a problem arises.

That means keeping software reasonably current, monitoring security advisories, maintaining reliable backups and understanding how to respond when an urgent vulnerability is disclosed.

Not every software update needs to be applied within minutes of release. Routine maintenance can generally be scheduled, tested and deployed in a controlled manner.

Critical security vulnerabilities are different. When a serious, exploitable issue emerges, the priority changes. Updates may need to be applied urgently, and temporary protective measures may be necessary while permanent fixes are prepared.

A good maintenance arrangement should accommodate both situations.

For my own Craft CMS clients, I aim to keep installations current, review significant security advisories and coordinate with hosting providers when server-level action is required.

That doesn't eliminate every possible risk — no maintenance arrangement can promise that — but it puts websites in a much better position to respond when something unexpected happens.

Related

Why Ongoing Website Maintenance is an Investment, Not a Cost

A website is like a company vehicle. Without regular servicing, it becomes slower, less secure and less effective at doing the job it was built to do.

Found in Blog

Still Running Craft CMS 4? It’s Time to Upgrade

Craft CMS 4 security support ended in April 2026. Find out what that means for your website, your upgrade options, and what you should do next.

Found in Blog

Craft CMS Support Plans

We take care of ongoing Craft updates, backups, monitoring, improvements — we don't just “build and disappear”.

Found in Services

Is Your Craft CMS Website Properly Maintained?

If you're responsible for a business website, there are a few questions worth asking.

• Is your website running a currently supported version of Craft CMS?
• Are its plugins and Composer dependencies being updated regularly?
• Is the server running a supported, security-patched version of PHP?
• Do you know who is responsible for server-level security updates?
• Are backups, monitoring and recovery procedures in place?

If you can't confidently answer those questions, it may be time for a review.

Importantly, you don't necessarily need a complete website rebuild or an expensive hosting migration.

Often, the first step is simply understanding what you have, identifying any gaps and putting a sensible maintenance plan in place.

A Timely Reminder

The PHP2Shell incident was a significant event for the PHP community, but it also demonstrated how quickly developers, hosting providers and security researchers can respond when a serious problem emerges.

For website owners, the lesson is straightforward. A secure website isn't something you build once and forget about. It's something you maintain.

That includes keeping Craft CMS updated, choosing well-supported plugins, maintaining the underlying server environment and having someone available who understands how those pieces fit together.

I've been developing and maintaining Craft CMS websites for more than a decade, helping businesses keep their websites secure, supported and performing reliably.

If you're unsure whether your Craft website is properly maintained, or you'd like someone to take responsibility for its ongoing updates and technical health, get in touch.

A little proactive maintenance today can save a great deal of trouble tomorrow.

Thanks for reading