How We Protect Your Website: PHP2Shell and Our New Vulnerability Protection
A serious security flaw called PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was recently found in PHP, the language that powers WordPress. It could let attackers run harmful code on a vulnerable server. Here's how our hosting kept your site safe.
Our PHP2Shell response
- Blocked attacks right away. Our firewalls, run with Cloudflare and our security partner Patchstack, stopped exploit attempts before the official PHP fix was released.
- Patched every server. We applied the security update across our whole network, including live, staging and inactive sites.
- No breaches. We've seen no sign that any site was affected. You don't need to do anything.
A new layer: WordPress vulnerability protection
Most WordPress attacks target known weak spots in plugins and themes. New ones are found every week, and there's often a gap between when a flaw becomes public and when a fix is available. That gap is when sites are most at risk.
Our hosting now includes vulnerability protection powered by Patchstack, at no extra cost:
- Constant checking. Your WordPress version, plugins and themes are compared against an up-to-date database of known vulnerabilities.
- Protection before fixes exist. If a plugin you use has a known flaw, attempts to exploit it are blocked, even before the developer releases an update. Your site files aren't changed.
- Always on. It runs on both live and staging sites and can't be accidentally turned off.
- Works with your plugins. It's compatible with all WordPress plugins and runs alongside other security tools.
Layered security for your site
Our enterprise firewall, DDoS protection and traffic monitoring filter out bad traffic based on who is sending it. Vulnerability protection adds a second layer that looks at what a request is trying to do, so it can stop targeted attacks even when they come from sources that look legitimate.
Protection doesn't replace updates, though. Updates fix the actual flaw in the code, which is why regular plugin and theme updates remain part of our maintenance.
Questions about your site's security? Contact us anytime.