PHP2Shell: What the PHP Vulnerability Means for Your Booking System

What PHP2Shell is

PHP is the programming language behind WordPress, Drupal, Joomla and a large share of small business websites. On 21 October 2026 the PHP project released emergency updates for two flaws in PHP itself, which researchers named PHP2Shell. Both are rated 9.2 out of 10 on the CVSS v4.0 scale.

• CVE-2026-109618: a very large form submission can make PHP run out of memory partway through a request. The cleanup code then treats half-built data as valid, which corrupts memory.
• CVE-2026-109619: state left over from one request can survive into the next request handled by the same PHP worker, after the memory behind it has been freed.

In both cases the attacker needs no account and no password. PHP reads the incoming request before the website's own code runs, so a login page, a security plugin or a firewall setting inside WordPress cannot stop it. Researchers found the flaws with the help of AI models, and exploitation attempts were seen before the patch was public.

Why it matters to a salon, clinic or restaurant

Most venues never think about PHP, because it sits underneath the website builder or the hosting plan, so an unpatched site can sit there for months without anyone noticing. Analysis cited on the PHP2Shell Wikipedia page counts about seven million companies running an affected PHP version, most of them with fewer than 50 staff. PHP also ships inside the hosting control panels many small hosts use, such as cPanel and Plesk.

An attacker who gets code running on your web server can change your pages, add a fake payment form, read what your contact forms collect, or use the server to attack others. The US NSA and the UK NCSC both told organisations that cannot patch straight away to take affected sites offline until they can.

What to check if your website runs on PHP

If your website runs on WordPress, Drupal, Joomla or a cPanel or Plesk hosting plan, it almost certainly runs PHP. These are the first fixed releases for each supported branch:

Four steps, in order

• Patch. On managed or shared hosting, email your host and ask which PHP version your site runs and whether it includes the 21 October fix. If you run your own server, install the updated PHP package.
• Restart. Installing the package is not enough while old PHP workers are still running. Restart PHP-FPM, rebuild container images and replace running containers so the old code is gone from memory.
• Filter at the edge, as a stopgap only. A firewall or proxy in front of the site, such as Cloudflare, can drop oversized and malformed form submissions. Setting changes passed around online, such as turning off session.upload_progress, do not fully protect you.
• Take it offline if you cannot patch today. A short outage is cheaper than a compromised server.

Is Gaplessly affected by PHP2Shell?

No. Gaplessly is written in TypeScript and runs on Node.js. The dashboard, your booking page, the booking button on your website and the websites we build for venues are served from Vercel. Bookings, clients and payment records live in a Postgres database at Supabase. The background service that sends confirmations and reminders is a Node.js container. None of these contain PHP, so there is nothing in them for these two flaws to reach.

On 22 October 2026 we also went through the other software we run. One internal admin tool on our server is written in PHP. It is not part of the booking app and is not used to take bookings, and it was already on its vendor's patched release.

There is nothing to update in your Gaplessly account and nothing you need to do in the dashboard.

Keep taking bookings while you patch your website

If your WordPress site has to go offline for a few hours, your Gaplessly booking page stays up, because it is hosted by Gaplessly rather than on your web server. Share your booking link on Instagram, in your email signature and anywhere else guests find you, and they can keep booking as normal until your site is back.