PHP Security Update: What We're Doing for Our Clients
Dynamic Digital as your digital partner is aware of today's critical PHP vulnerabilities (PHP2Shell) and is actively patching and monitoring client websites.
As you may already be aware, today, October 21, 2026, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, now widely referred to as "PHP2Shell." PHP powers WordPress and a large share of websites worldwide, and cybersecurity agencies in the US, UK, and EU have urged site owners to update right away.
Dynamic Digital is aware of this issue and on it. Our team is working through every client website we host or maintain. We're applying the patched PHP versions (8.2.35, 8.3.36, 8.4.27, or 8.5.12) as they become available to our systems, confirming each site is running a supported version, and monitoring for any signs of suspicious activity.
Status: Most of our client sites are already updated, and we expect to finish the remaining sites by the end of the day, depending on upstream service providers.
What this means for you
- You don't need to take any action. We are handling these updates proactively.
- Some sites may go into brief maintenance while updates are applied. If a site is running an older PHP version that can't be patched, we may take it offline temporarily to keep it safe, and we'll contact you directly if that happens.
We'll update this post as work progresses. Questions? Reach out to us at support@ddacorp.com if you have any questions or concerns.
Last updated: October 21, 2026
Talk through this with us
If you want help applying these ideas to your team, we are happy to walk through options in a short call.
We’re ready when you are.
Schedule a free 15-minute discovery call.
We'll listen to where you are and share how we can help.