Last week, a serious security flaw in PHP sent the whole internet scrambling to update. PHP is the programming language WordPress runs on, so every WordPress news site was at risk.
If PaywallProject hosts your site, you were covered from the start. Here’s the short version:
- Blocked at the edge: attacks were turned away before a fix existed.
- Patched the same day: fixed PHP went live on the same day PHP released it.
- Action needed: none.
Below is what happened, how our hosting partner handled it, and why it matters for a small newsroom.
What is PHP2Shell?
On October 20, PHP announced two critical flaws, CVE-2026-109618 and CVE-2026-109619. Together they’re known as PHP2Shell. They let attackers take over any site running PHP, WordPress included.
Two things made it worse. Details leaked early. And attackers were using them before a fix existed. So waiting for the official patch was not enough. Sites needed protection in the gap.
How it played out
Every PaywallProject-hosted site runs on the same hosting infrastructure, run by our hosting partner. Their engineers ran this one end to end. Here’s the timeline they shared with us.
- Oct 20, overnight: getting ready before the fix. Our hosting partner monitors hundreds of security channels around the clock, so they were working on this before an official fix existed. The public source they normally get PHP from was offline for days. So their engineers spent the night building their own way to compile PHP, ready to build the fix the moment it dropped. PHP said it might release the fix early, so they watched for it all night.
- Oct 21, early morning: stopping it at the edge. Their own firewall rules, written and managed by their engineers, went live across the network first. Cloudflare’s emergency rules backed them up. That meant attack traffic was turned away before it reached a server. They also switched off the PHP feature the attack depends on and blocked attacking IP addresses network-wide.
- Oct 21, 9 AM Central: PHP releases the fix. Their engineers were building patched PHP seconds later. Public package sources timed out as the whole internet tried to update at once. Their setup didn’t depend on those sources, so it kept going.
- Oct 21, same day: patched PHP everywhere. Tested builds of every PHP version from 7.4 to 8.5 rolled out in batches. Sites saw a PHP restart of a second or two.
Our hosting partner has now finished patching PHP2Shell across its entire network, which includes every PaywallProject-hosted site. They report no evidence of any breaches related to the vulnerability.
PHP versions patched
Every PHP version from 7.4 to 8.5 got a fix. For older versions, the fix was backported, which means it was copied into that older version.
| PHP version | Patched release | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Patched |
| PHP 8.4 | 8.4.27 | Patched |
| PHP 8.3 | 8.3.36 | Patched |
| PHP 8.2 | 8.2.35 | Patched |
| PHP 8.1 | Backported fix | Patched |
| PHP 7.4 | Backported fix | Patched |
Who did the work
Credit where it’s due. The overnight build work, the firewall rules and the patched PHP all came from our hosting partner’s engineers. Cloudflare and the security company Patchstack added their own protections on top.
Our part was choosing that partner and working with them. We picked a host that watches for threats around the clock and can act before an official fix ships. Weeks like this one are why.
Why managed hosting matters for small newsrooms
Most local newsrooms don’t have a security team. Your staff is busy reporting, editing and selling ads. Nobody should have to watch security channels overnight or rebuild server software in the middle of the night.
PHP2Shell moved fast. The attacks started before the fix. A newsroom that waited for news coverage, then for an update button, would have been behind. With managed hosting, that work happens without you. You find out after it’s done.
What you need to do
If PaywallProject hosts your site: nothing. Your site is already on patched PHP. You don’t need to update anything or change any settings.
Running PaywallProject on your own hosting? Ask your host to confirm your site runs one of the patched PHP versions in the table above.
New to PaywallProject? It’s the managed WordPress paywall for local news, set up and run by our team. Get started or book a 30-minute call.
