In August 2026, a cybersecurity researcher was able to render a theorised weakness in the PHP engine as a tangible attack vector using an AI tool.

On 21st October 2026, the embargo surrounding these vulnerabilities (CVE-2026-85880 & CVE-2026-81963) alerted all hosts and server admins to prepare for an incoming patch to PHP to remedy the vulnerability. Our immediate reaction was to bring up all of our sites from any older versions of PHP up to PHP 8.3, as well as suspending some of our archaic domains for maximum defensive posture. We obtained and installed the proposed patches as soon as they became available.

As of 22/10/2026 we are patched and protected against the PHP2SHELL exploit.