If your website is hosted with Goldstein Media, it is protected against the two critical PHP flaws disclosed this week, and you do not need to do anything. Along with our hosting partner, all our clients sites have been patched and everything is secure.
On October 21, 2026, the PHP project shipped an emergency update for two vulnerabilities, now nicknamed PHP2Shell. They are serious: an attacker who never logs in can potentially take over a web server. Attacks were spotted in the wild before the fix even came out. Here is what happened, who is at risk, and what we did about it.
What the vulnerability is
Two bugs in PHP itself let an unauthenticated attacker run their own code on a vulnerable server. Both are rated 9.2 out of 10 (CVSS v4.0), which is critical.
Who is at risk
Any server running an unpatched PHP that answers web requests is exposed, no matter how PHP is set up. Apache with mod_php is the highest-risk setup, because the attack can land before the website’s own code even loads.
The people who need to act fastest are those running their own servers or VPS, since no one patches those for them. Sites on PHP 8.1 or older are in a tougher spot too: the PHP project no longer updates those versions, so the fix depends on a vendor backporting it.
Why Goldstein Media sites are protected
We manage PHP on our servers, so the fix was our job, not yours, and it is done.
What you should still do
Nothing is required on your end. If your site has any piece that runs somewhere other than our servers, such as a separate VPS, a staging copy you host yourself, or another provider, check that it has the PHP update too.
Questions? Shoot us an email. We are happy to confirm your site’s PHP version and patch status.
