On October 21, the PHP project disclosed two critical security flaws in PHP, the programming language that powers a large share of the web, including WordPress, most content management systems, and our own mmCMS platform. Security researchers have nicknamed the pair “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619). The same day, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) urged every organization running PHP to patch immediately: read the CISA alert.
If you have seen the headlines and wondered whether your website is at risk, here is the short answer: the websites we host and manage have been patched, and you do not need to do anything. Below is a full account of what happened, what we did, and why we believe the way mmCMS is built puts our clients in a stronger position for the next one.
What PHP2Shell is, in plain English
PHP is the engine that runs behind the scenes when a page on a website is built. These two flaws are in that engine itself, not in any one website or plugin. Under the right conditions, an attacker could send a specially crafted request to a vulnerable server and run their own commands on it, without needing a password. That is why the vulnerabilities were rated critical, and why security firms began reporting attempts to exploit them within hours of the announcement.
Because the flaw is in PHP itself, it affects every platform built on PHP until the server is updated. That includes WordPress, other popular content management systems, and mmCMS. No platform gets a pass on a problem in the language underneath it. What separates platforms is how quickly and how safely the fix reaches every site.
What we did
- Same-day assessment. We reviewed the advisories as soon as they were published and took an inventory of every server and website in our care that runs PHP.
- Every mmCMS site patched. Our mmCMS client sites run on servers we manage directly. We upgraded them to the fixed release of PHP (8.3.36) and then checked every site address one by one to confirm it was back and behaving exactly as before.
- WordPress sites patched and modernized. For the WordPress sites we manage, we installed the security fix, moved them onto the current, fully supported PHP 8.3.36 release, and brought WordPress itself, along with themes and plugins, up to date. We tested each site page by page afterward.
- Tightened along the way. While we were in there, we retired legacy test environments, removed old and unused software, and are closing off anything that does not need to be reachable from the internet. Patching day is a good day to clean house.
Why mmCMS puts you in a stronger position
We built mmCMS because we wanted our clients on a platform we could fully stand behind. Weeks like this one show why that matters.
One fix protects every site at once. mmCMS sites run on infrastructure we manage centrally. When PHP needed an urgent update, a single, tested upgrade covered every mmCMS site together. There was no waiting on individual site owners, hosting control panels, or a long checklist of separate servers.
No open plugin marketplace. With WordPress, much of the risk comes from third-party plugins and themes written by thousands of different developers with very different standards. Industry security reports consistently find that the vast majority of WordPress vulnerabilities live in plugins, not in WordPress itself. mmCMS takes a different approach. Its features, which we call Mendols, are built, reviewed, and released by our own team. A site only runs code we know and maintain.
Every update is tested before it ships. Each mmCMS release goes through automated test suites and side-by-side visual comparisons of real pages, and it rolls out to a small set of sites first before it reaches everyone else. Fixes get to you quickly without breaking what already works.
Built on a modern, security-first foundation. mmCMS is built on Laravel, a modern PHP framework with strong protections turned on by default, such as defenses against form forgery, safe database queries, and properly hashed passwords. It also leaves out much of the legacy surface that attackers routinely probe on older platforms.
What is next on the mmCMS roadmap
Security is not a single event. It is a habit built into how a platform is designed and run. The next major release of mmCMS, version 3.0, is in its final stretch of real-world testing, and it continues to raise the bar:
- Safer add-ons. Mendols are being moved to a stricter, plugin-safe model, so each feature stays in its own lane and can be updated or rolled back on its own.
- Faster, safer rollouts. Every update is checked automatically against each site’s own pages before it goes live, with an instant path back if anything looks off.
- Continuous health checks. Our platform keeps track of each site’s version, health, and pending updates, so issues surface on our side before they become yours.
If you are still running a WordPress site today, it remains fully supported and patched by our team. We are always happy to talk about whether moving to mmCMS makes sense for you.
What you need to do
Nothing. Your website, your logins, and your content stay exactly as they are. If you notice anything on your site that does not look right, or you simply want to talk through what this means for your business, reach out to us. We are glad to help.