A critical PHP vulnerability dropped this week. Here’s what we did about it, and why it matters for your Real Estate website.
On October 21, the PHP project disclosed two critical security flaws, nicknamed “PHP2Shell,” that affect essentially every website running PHP. That’s a lot of websites. PHP powers most of WordPress, most real estate sites, and the Union Street Media platform.
By the morning of October 22, every server on our platform was patched. If your site is with us, nothing happened to it and nothing is needed from you. This post is about how that went, because it says something about why we build the way we do.
The hard part wasn’t the fix. It was the old code.
Our platform runs on two generations of code side by side. Every client site uses both: newer features run on current PHP, and a set of core pages and services still runs on PHP 7.4. The current-PHP side was a package upgrade as soon as Amazon published it, done by early morning on the 22nd.
PHP 7.4 was the problem. It reached end-of-life in 2022, which means no official patched package exists. For most of the web, that’s where the story ends: anything on old PHP just stays exposed until someone migrates it.
Our engineering team didn’t accept that. The PHP security team had published the raw source code of the fix. Our team took it, built a patched PHP 7.4 from scratch, tested it against real client sites, and rolled it out to every server. About 24 hours after the disclosure, every part of every site was patched.
What covered the gap
A 24-hour window is still a window. Within hours of the disclosure, before any patch existed, we added protective layers across the platform: firewall rules blocking the known attack pattern, limits on the kind of request the exploit relies on, and the configuration changes the PHP security team recommended. Those stayed in place until the patches landed, and they’re staying in place now as a second line.
Why this matters if you’re shopping for a real estate website platform
Most real estate websites are a theme, a dozen plugins, and a hosting account someone set up years ago. When a vulnerability like this hits, the question becomes: who is watching? Who patches at 6am? Who knows how to rebuild PHP from source when the vendor says there’s no update?
On a managed platform, that’s us. Our team owns the whole stack, from the firewall to the code that renders your listings, and that’s what made a same-day response possible. It isn’t a feature we list on a pricing page, but it’s the one that mattered this week.
For your IT team
The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2). Details are in the PHP project’s release announcement.
If you’d like to talk to our team directly about the mitigations and patches applied to our platform, reach out to your account manager and we’ll set it up.
