PHP2Shell Vulnerability: How We Protected Our Customers' Websites

Website security is something every business should take seriously, but occasionally, new vulnerabilities emerge that require hosting providers to act quickly.

On 21st October 2026, two critical security vulnerabilities affecting PHP were publicly disclosed, creating a potential risk for websites running affected versions of the software. Known collectively as PHP2Shell, the vulnerabilities could allow attackers to remotely execute malicious code on vulnerable servers.

At Vista Design, keeping our customers' websites secure is a priority. As soon as the issue emerged, our technical team took immediate action to protect our hosting infrastructure, introducing additional security measures and applying the official updates as soon as they became available.

Here's what happened and how we responded.

What Was the PHP2Shell Vulnerability?

PHP is one of the most widely used programming languages on the web, powering millions of websites, including many WordPress websites and e-commerce platforms.

The PHP2Shell issue involved two critical vulnerabilities that could allow unauthorised attackers to execute code remotely on affected servers.

In simple terms, this meant that websites running vulnerable versions of PHP could potentially be exposed to security risks, including unauthorised access and malicious activity.

With the severity of the vulnerabilities becoming clear, it was important for hosting providers to act quickly to protect their servers while preparing to install the official security updates.

How Did We Protect Our Customers' Websites?

As soon as the vulnerabilities were identified, we began introducing additional security measures across all our hosting servers.

Rather than waiting for the official updates to become available, we took immediate steps to reduce potential risks while keeping our customers' websites accessible.

1. Introducing Immediate Security Measures

Early on the morning of 21st October, we introduced temporary restrictions across all hosted websites. We disabled website form interactions and file uploads, while keeping websites online in read-only mode. This helped reduce potential exposure while allowing visitors to continue accessing websites as normal.

2. Adding Further Protection with Specialist Security Software

Later that afternoon, we introduced another layer of protection through our specialist security software. This allowed us to reactivate website forms while maintaining restrictions on file uploads, giving customers back important website functionality without removing the additional security measures.

3. Applying the Official PHP Security Updates

As soon as the official PHP security releases became available, we began rolling out the updates across our hosting infrastructure. By late evening on 21st October, all of our servers had been patched with the relevant PHP security releases. This ensured the underlying vulnerabilities were addressed, rather than relying solely on temporary protective measures.

Were Any of Our Customers' Websites Affected?

We're pleased to confirm that all of our servers remained uncompromised throughout the incident.

By acting quickly, introducing additional layers of protection and applying the official security updates as soon as they were released, we were able to keep all hosted websites online safely throughout the event.

There was no prolonged downtime, and our customers' websites remained protected while we worked through the necessary security measures.

Why Is Proactive Website Security So Important?

Incidents like PHP2Shell highlight why website security needs to be an ongoing priority for businesses.

It's not simply a case of installing updates when they become available. Keeping websites secure involves continuous monitoring, reliable hosting infrastructure, specialist security software and the ability to respond quickly when new threats emerge.

For businesses that rely on their websites to generate enquiries, process orders and communicate with customers, website downtime or a security breach can have serious consequences.

At Vista Design, we understand how important your website is to your business. That's why we take a proactive approach to website hosting and security, monitoring potential threats and taking action to help keep our customers' websites safe, secure and online.

Your website is an important part of your business, and keeping it protected should always be a priority.