KEY TAKEWAYS:
Your DSS website is not affected. PHP2Shell targets PHP, and the DSS platform doesn't use PHP. Your website needs no patch or other action.
Cloudflare adds a second layer. DSS websites sit behind Cloudflare, which added protection against PHP2Shell on Oct. 21, 2026.
There's no downtime. Nothing needs patching, so your website stays up and unchanged.
Check your third-party tools. Chat widgets, intake forms, scheduling, and payment tools run on their vendors' own servers. If your risk team asks about vendors, those companies need to answer for their own systems.
Check any non-DSS websites you own. An old WordPress blog or landing page hosted elsewhere may still be running vulnerable PHP. Ask its host which version it runs.
Got a security notice? Forward it to us. We'll review it and give you an answer you can send to your risk team.
In October 2026, security researchers disclosed two critical flaws in PHP, the programming language that runs WordPress and millions of other websites. Together they're known as PHP2Shell, and they let an attacker take control of a web server without a password. Websites built on Foster Consulting's Dynamic Self-Syndication (DSS™) platform don't run PHP, so this PHP vulnerability does not affect them.
If a client, bank, or insurance carrier has sent you a vendor questionnaire about PHP2Shell, you're not alone. Risk teams are asking every vendor the same questions this month. Below is what happened, why WordPress sites are exposed, and how to answer those questions for a DSS website.
Table of Contents
What Is the PHP2Shell Vulnerability?
PHP2Shell is the nickname for two flaws, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 out of 10 (critical). Wiz Research found them with Calif and OpenAI and reported them privately to the PHP security team in August 2026, according to Recorded Future's analysis of the PHP2Shell exploits.
Both bugs are in how PHP cleans up after a request fails. When PHP runs out of memory partway through handling a request, such as a file upload, it can quit without tidying up. Leftover scraps of memory carry over to the next request on that server, and a carefully built request can turn those scraps into a way to run the attacker's own code.
Two details make this one serious:
-
It happens before the website's own code runs. A well-built site offers no protection if the PHP underneath it is vulnerable.
-
The patch window collapsed. Technical details leaked before PHP's fix was ready. The security firm Patchstack received reports of active attacks from hosting companies early on Oct. 21, 2026, before PHP released patched versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12 later that morning.
Older PHP versions that are no longer supported won't get an official fix at all.
Why WordPress Sites Are Exposed to This PHP Vulnerability
PHP builds every WordPress page on the server each time someone visits. So when PHP itself has a hole, every WordPress site on an unpatched server has that hole too. Wiz demonstrated takeovers of WordPress, Drupal, and Joomla sites without any login during its research.
Updating WordPress or its plugins won't fix it. The repair has to happen in the PHP software on the server, which the hosting company usually controls. Many site owners don't know which PHP version their host runs, or when it last changed.
That's where the real risk is. Internet scans cited by Recorded Future found about 5.1 million IP addresses running PHP. Among servers that reveal their version, roughly 758,000 run PHP releases past end of life, compared with about 272,000 on supported releases. Those older servers won't receive an official PHP2Shell patch.
The damage can also reach past the website. Wiz showed one of the flaws can leak passwords, login tokens, and API keys from other visitors' requests, even without a full takeover.
None of this is a mistake by WordPress developers. It comes from building on a stack where the site inherits every flaw in the language beneath it and every plugin on top of it, and depends on a host to keep all of it current.
How DSS Websites Avoid the PHP2Shell Risk
DSS doesn't use PHP. Foster Consulting's technical team has reviewed the PHP2Shell advisory and confirmed that no part of the DSS platform runs on it. An exploit aimed at the PHP runtime has nothing to land on, so DSS websites need no PHP update or patch.
That finding covers more than the pages your visitors see. DSS also runs the content management system, the DSS CRM and lead management tools, video management, and reputation management for Foster Consulting clients. Contact form submissions and leads collected through a DSS website are handled inside the same platform.
DSS websites also sit behind Cloudflare, which added protection against PHP2Shell on Oct. 21, 2026. (See Cloudflare's announcement for details.) For a PHP site, Cloudflare stresses that these rules are a backup and the server still needs patching. For a DSS site, there's no PHP to patch, so Cloudflare is an extra layer on top.
What to Do If You Receive a Security Notice
Forward it to Foster Consulting through our client support team. We'll review it against your website and reply with an answer you can pass along to your risk team.
If your business runs any other website outside DSS, such as an old WordPress blog, a landing page, or a client portal, ask whoever hosts it which PHP version it's running. A PHP2Shell fix means PHP 8.2.35, 8.3.36, 8.4.27, 8.5.12, or a vendor-patched equivalent. Anything older needs attention now.
What DSS Clients Can Count On With PHP2Shell
-
No PHP to attack. DSS doesn't run PHP, so PHP2Shell can't reach it.
-
Cloudflare in front. Cloudflare screens traffic before it reaches your website.
-
Straight answers from the people who built it. When a client, bank, or insurer sends a security questionnaire, you can get a direct answer from the Foster Consulting team.
If your practice website runs on WordPress today and you'd like to see what moving to DSS would involve, talk with the Foster Consulting team.