Security · PHP flaw

A critical PHP flaw took websites offline. Scalus sites were never affected

· 2 min read · Tim McCartney

Two frames from the Scalus security video: red alerts saying councils shut their websites and sites were taken over without a login, then the calm line Every Scalus site checked the same morning, not one runs on PHP

On Wednesday 21 October 2026 the people who look after PHP released an urgent security fix. PHP is the language underneath most WordPress sites, and Drupal and Joomla sites too. The flaw, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), lets an attacker take over a site without logging in, and attacks had already started.

What happened

It is rated critical, and it reaches every version of PHP from 5.4 onwards, which covers more than ten years of websites. Within a day, councils, universities and governments around the world took their websites offline while they patched.

What I did

I checked every Scalus website on the morning of 22 October, one by one. Not one of them runs on PHP, so none of them was exposed and none had to come down.

Every Scalus site checked the next morning. Not one runs on PHP.

Why Scalus sites were never affected

Scalus sites are not built on WordPress and a pile of plugins. The platform is updated every day, there are no plugins to fall behind, and there is no server sitting somewhere waiting for a business owner to log in and patch it. Every client's data and systems sit behind the same safeguards, whether they joined last year or last week.

I now also check worldwide security alerts four times a day, so the next one is looked at the morning it lands.

If your website runs on WordPress

Ask your host one question this week: has PHP had the 21 October security update? These versions have the fix:

PHP 7.4, 8.0 and 8.1 get no official fix. If your site is on one of those, ask your host to move it to 8.2.35 or later. If they are not sure, ask them to check today.

Questions about this one

Were any Scalus websites affected by the PHP flaw?
No. I checked every Scalus website on the morning of 22 October 2026, the day after the fix was released. None of them runs on PHP, so none of them was exposed and none had to be taken offline.
What is the PHP flaw in the news?
Two critical security flaws in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), made public on 21 October 2026. They let an attacker take over a WordPress, Drupal or Joomla site without logging in, and attacks had already started.
Is my WordPress website at risk?
If it runs on PHP 5.4 or later and has not had the 21 October security update, yes. Ask your host whether PHP has been updated. If they are not sure, ask them to check today.
Which PHP versions fix it?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 or later. PHP 7.4, 8.0 and 8.1 get no official fix, so a site on one of those needs to move to 8.2.35 or later.