---
title: We don't run PHP. Your website does.
description: Explore the implications of recent PHP vulnerabilities and how they affect web security, particularly for HubSpot and WordPress users. Stay informed and proactive.
image: https://www.protagx.com/hubfs/Neon%20Server%20Stack%20Under%20Siege.png
---

[Skip to content](https://www.protagx.com/en/ddd/we-dont-run-php-your-website-does#main-content)

- [English](https://www.protagx.com/en/ddd/we-dont-run-php-your-website-does)
- [Deutsch](https://www.protagx.com/de/ddd/wir-haben-kein-php-ihre-website-schon)

 English

This is a search field with an auto-suggest feature attached.

- There are no suggestions because the search field is empty.

[![protagx-logo (1024 × 300 px)](https://www.protagx.com/hubfs/logos/protagx-logo%20(1024%20%C3%97%20300%20px).svg "protagx-logo (1024 × 300 px)")](https://protagx.com?hsLang=en)

- Product 
    - [protagx for Hubspot, Salesforce & Co](https://www.protagx.com/en/crm)
    - [protagx New Customer Engine](https://www.protagx.com/en/your-new-business-engine)
    - [protagx Digital Ads Power](https://www.protagx.com/en/crm-service-ad-conversion-machine)
    - [protagx Day One Setup](https://www.protagx.com/en/crm-setup-services)
- Why protagx? 
    - [Demystifying the Data Forest](https://www.protagx.com/en/ddd/revolutionizing-healthcare-through-data-mesh-framework)
    - [Embracing Modernization in Clinical Trials](https://www.protagx.com/en/ddd/embracing-modernization-in-clinical-trials)
- [DDD Blog](https://www.protagx.com/en/ddd) 
    - [Data Diver's Dialogs](https://www.protagx.com/en/ddd)
- Company 
    - [About](https://www.protagx.com/en/about-protagx)
    - [Support](https://www.protagx.com/en/support)
    - [My tickets](https://portal.protagx.com/my-tickets)
    - Ressources 
          - [Client Projects](https://www.protagx.com/en/references)
          - Ebooks (demnächst)
- [Contact](https://www.protagx.com/en/contact)

- [Support](https://www.protagx.com/en/support?hsLang=en)
- [Book a Meeting](https://www.protagx.com/en/consultation?hsLang=en)
- Search

- [Hubspot](https://www.protagx.com/en/ddd/tag/hubspot),
- [Cybersecurity](https://www.protagx.com/en/ddd/tag/cybersecurity),
- [GxP-Validierung](https://www.protagx.com/en/ddd/tag/gxp-validierung),
- [Wordpress Erweiterungsmodul](https://www.protagx.com/en/ddd/tag/wordpress-erweiterungsmodul),
- [Php2Shell](https://www.protagx.com/en/ddd/tag/php2shell),
- [Node2Shell](https://www.protagx.com/en/ddd/tag/node2shell),
- [eMudhra](https://www.protagx.com/en/ddd/tag/emudhra)

# We don't run PHP. Your website does.

![We don't run PHP. Your website does.](https://www.protagx.com/hubfs/Neon%20Server%20Stack%20Under%20Siege.png)

- October 23, 2026

![Christian Schappeit](https://app.hubspot.com/settings/avatar/25b53a713bed514f3afd959a888660b9)

[Christian Schappeit](https://www.protagx.com/en/ddd/author/christian-schappeit)

*Data Divers Dialogs · Analysis*

**The most repeated sentence of the October disclosures was true almost everywhere it was said. It described the team. The attackers only ever asked about the servers.**

By Christian Schappeit · Data Divers Dialogs · October 2026 · approx. 6 min read

---

Late on Wednesday, 21 October, HubSpot's status page closed an incident with one sentence: "PHP isn't part of HubSpot's infrastructure." It was correct. By the weekend it had become the sentence of the week, in a slightly shorter form.

*We run JS, not PHP.*

I have heard some version of it from almost every team I've talked to since. It is said with relief, the way people say they weren't on the flight. And it is usually true. It just answers a question nobody was asking.

Four days before PHP published anything, on Saturday, 17 October, a honeypot run by Amazon received a request aimed at the flaw. The machine sending it did not ask which language the target's developers prefer. It asked what was answering.

**THE WEBSITE**

## The one server nobody draws.

Ask a development team for its architecture and you get the systems it builds, the services and the CRM integration. You rarely get the marketing website, because the marketing website belongs to marketing, was built by an agency and runs on WordPress at a host whose invoice goes to a different department.

That website is where the HubSpot forms live. The plugin that puts them there runs on whatever PHP sits underneath. HubSpot's Trust Center confirmed this week that the plugin itself needs no patch, which is accurate and, like Wednesday's sentence, about PHP.

The PHP is the problem. Amazon now describes the flaws as "broadly exploited in the wild", and watchTowr reports attempts against both CVEs. Nobody has shown which attempts succeeded. WordPress.org went further than platforms usually do: self-hosted sites on PHP older than 8.2 should consider taking the site offline while they prepare the update. A third CVE, published on 23 October, isn't fixed in this week's releases at all.

> "We run JS, not PHP" is a sentence about the team. Attack surface is a sentence about servers.

**THE OTHER HALF**

## And the teams that do run JS had the worse week.

This is the part the relief tends to skip. "No PHP" just means the other three get you instead.

On 23 October, the advisory for `body-parser` went public. A single request with a compressed body and a few trailing bytes kills the Node process. Gzip is enough, so Express 4 is hit as well as Express 5. The parser runs before routing, so nobody needs a login or a valid route. A HubSpot webhook receiver doesn't get as far as checking the signature. It just stops. On Friday I wrote that Express 4 was the safer version. For this bug it isn't.

Next.js, meanwhile, had two critical flaws that need no login, one in the image optimizer and one in `use cache`. The fix is a version bump, 16.4.3 or 15.5.28. There's a catch, though. On the 15 line, an old `sharp` can survive the upgrade in the lockfile. Next.js 15 left support on 21 October anyway.

And then there is Node2Shell, the flaw with the cinematic name, the working exploit and the most coverage. It has, so far, no confirmed victims. The bug everyone could name is the one that hasn't hurt anyone yet. The ones that can switch off a receiver today have numbers.

**FIVE PLACES**

## "JS" gets patched in five places.

The other trouble with "we run JS" is that it sounds like a single item. It's the Node runtime, the npm packages, the framework, the Docker image and the CI runner, and each one is patched somewhere else and tested differently.

`npm audit` checks the packages. It's valid evidence for the `body-parser` crash and silent about Node2Shell, because that flaw lives in Node, not in a package. The Docker build can quietly reuse an old base image. GitHub's hosted runner image from 23 October still ships unpatched Node 22 and 24, so `node-version: 22` gets you an unpatched build. Debian's own `nodejs` package is still flagged vulnerable. Every one of these checks can come back green over an unpatched estate.

This kind of denial doesn't need stubbornness. A dashboard that agrees with you is enough.

**THE NIGHT SHIFT**

## I wrote a routine that disagrees with my instincts.

I spent the night after Friday's article turning all this into a procedure that runs in any repository and leaves a record behind. My instinct said start with Node, because Node was the headline. The routine starts with `body-parser`, because it can kill a process today on both Express versions. Then Next.js, then the runtime, then certificates, PHP, images and CI. HubSpot comes last, because there the customer can measure but not patch.

It measures before it changes anything, because a version number proves an installation, not a replaced decoder. It refuses to fix a certificate error by switching off verification. And it reports Node 20 or PHP 8.1 as a risk with an owner rather than as finished work. None of that is clever. A dashboard just never suggests it.

**EMUDHRA**

## The only party that drew a conclusion left.

In a week of "not our problem", one company said something different. On 22 October, eMudhra's board decided to "voluntarily withdraw from the global SSL/TLS certificate business". The business was about 1% of revenue. Mozilla's analysis had found that some of the affected private keys were integers below 256. A number that small, you could try by hand before lunch.

Chrome removes eMudhra's G3 root on 27 October. Google is still deciding about the rest.

HubSpot, for completeness, still documents `nodejs20.x` as its only serverless runtime, on a Node line that gets no more fixes, and still has said nothing about Node.js or eMudhra. Its two statements of the week were both about PHP. Both were correct.

### If you run JS

`body-parser` **first.** 1.20.9 or 2.4.0, on Express 4 and 5. `npm update body-parser`, commit the lockfile. Until then, `inflate: false` where endpoints never receive compressed bodies.

**Then Next.js.** 16.4.3 or 15.5.28, then `npm ls sharp`: 0.35.5 or later. Plan the move off 15.

**Then Node.** 22.23.4, 24.22.1 or 26.12.1. Test with the zlib constant, not the audit.

**Then the places nobody checks.** `docker build --pull`, `check-latest: true` in CI, the official Node binary instead of Debian's package.

### If your website runs WordPress

**Treat it as under attack.** Look up the PHP version under Site Health. Below 8.2 with no confirmed host backport: consider WordPress.org's advice and take it offline until it's updated.

**Set** `session.upload_progress.enabled=0`**.** It covers the third CVE, which has no fix yet.

**Leave the HubSpot plugin alone.** It doesn't need a patch. The PHP under it does.

**Ask your host which day they patched.**

### Dates for the diary

**27 October 2026: Chrome removes the eMudhra G3 root.** A second wave for the remaining roots is possible.

**31 December 2026: PHP 8.2 reaches end of life.**

**8 January 2027: HubSpot's CLI requires Node 22.**

**BACK TO THE HONEYPOT**

## Nobody reads your architecture diagram.

"We run JS, not PHP" is true in most of the companies I see. It is a perfectly good description of who writes what. It just isn't a description of what is reachable, and the week was decided entirely by the second thing.

On 17 October, a machine somewhere sent one request into the internet and waited to see what would answer.

Your website did.

---

**Figures and sources.** HubSpot status incident "Update on PHP security vulnerability", resolved, 21 October 2026, 23:31 EDT. PHP CVE-2026-109618 and CVE-2026-109619, fixed 21 October; CVE-2026-115560, 23 October, not fixed in those releases. body-parser CVE-2026-111181 / GHSA-27r3-jxmh-p828: CVSS 3.1 7.5, affected 2.0.0 to below 2.4.0 and all versions below 1.20.9, published 23 October. Next.js CVE-2026-96889 / GHSA-2464-fhr4-w9xw: CVSS v4 9.5, glibc Linux, requires `sharp` 0.35.5; GHSA-673q-mjm6-r5xr (`use cache`, 16.x); targets 16.4.3 or 15.5.28. Node.js CVE-2026-111497 ("Node2Shell"), fixed in 22.23.4, 24.22.1 and 26.12.1. eMudhra exit announced 22 October 2026. Chrome removal of `emSign ECC Root CA - G3` from 27 October 2026.

On confidence. The PHP exploitation reports come from Amazon Threat Intelligence (reported by Tenable, 23 October) and from watchTowr; neither shows a successful compromise, and CISA had not listed the CVEs as of 23 October. Node2Shell had no confirmed exploitation in the wild as of 23 to 24 October (Sysdig, The Hacker News). The WordPress.org guidance, the HubSpot Trust Center statement on the plugin, Mozilla's finding on key size, the GitHub runner image contents and the Debian `nodejs` status were verified on 25 October in protagx's own remediation research and are cited from there. Next.js 15's end of support follows the Next.js support policy as reported. The remark that the sentence was heard from many teams is the author's own observation, not a survey.

Primary reporting: [HubSpot status: Update on PHP security vulnerability](https://status.hubspot.com/incidents/1vjy2fdyvnv5) · [Tenable: php2shell FAQ](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote) · [watchTowr: PHP2Shell](https://watchtowr.com/intelligence/php-remote-code-execution-php2shell/) · [OSV: body-parser GHSA-27r3-jxmh-p828](https://osv.dev/vulnerability/GHSA-27r3-jxmh-p828) · [OSV: Next.js GHSA-2464-fhr4-w9xw](https://osv.dev/vulnerability/GHSA-2464-fhr4-w9xw) · [Node.js: October 2026 Security Releases](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases) · [Sysdig: Node2Shell](https://www.sysdig.com/blog/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce) · [eMudhra: exit from global SSL/TLS business](https://emudhra.com/en/press-release/emudhra-to-exit-global-ssl-tls-certificate-business) · [The Record](https://therecord.media/indian-tech-company-announces-withdrawal-certificate-business-incident) · [Debian security tracker: brotli](https://security-tracker.debian.org/tracker/source-package/brotli).

Tags: HubSpot, WordPress, PHP2Shell, body-parser, Next.js, Attack Surface, Change Control

End

 Related Posts

## You may also like this

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique.

[![Claude does the work. The audit trail says you did.](https://www.protagx.com/hubfs/Gemini_Generated_Image_szokxbszokxbszok.jpg)](https://www.protagx.com/en/ddd/claude-does-the-work.-the-audit-trail-says-you-did?hsLang=en)

[Audit-Trail](https://www.protagx.com/en/ddd/tag/audit-trail), [Claudeforce](https://www.protagx.com/en/ddd/tag/claudeforce), [Agentforce](https://www.protagx.com/en/ddd/tag/agentforce), [Annex 11](https://www.protagx.com/en/ddd/tag/annex-11), [GxP-Validierung](https://www.protagx.com/en/ddd/tag/gxp-validierung)

### [Claude does the work. The audit trail says you did.](https://www.protagx.com/en/ddd/claude-does-the-work.-the-audit-trail-says-you-did?hsLang=en)

 September 4, 2026

 Data Divers Dialogs · Analysis · By Christian Schappeit · September 2026 · approx. 7 min read

[Read more](https://www.protagx.com/en/ddd/claude-does-the-work.-the-audit-trail-says-you-did?hsLang=en)

[![protagx - CRM common sense model for Vibe coders](https://www.protagx.com/hubfs/CRM-common-sense-model-for-vibe-coders.png)](https://www.protagx.com/en/ddd/the-champion-who-forgot-his-own-style?hsLang=en)

[CRM](https://www.protagx.com/en/ddd/tag/crm), [Hubspot](https://www.protagx.com/en/ddd/tag/hubspot), [Partner Economics](https://www.protagx.com/en/ddd/tag/partner-economics), [SaaS Pricing](https://www.protagx.com/en/ddd/tag/saas-pricing), [Inbound](https://www.protagx.com/en/ddd/tag/inbound), [TCO](https://www.protagx.com/en/ddd/tag/tco)

### [The Champion Who Forgot His Own Style](https://www.protagx.com/en/ddd/the-champion-who-forgot-his-own-style?hsLang=en)

 August 19, 2026

 The Champion Who Forgot His Own Style Data Divers Dialogs · Critique · ~8 min read

[Read more](https://www.protagx.com/en/ddd/the-champion-who-forgot-his-own-style?hsLang=en)

[![Salesforce had a very good quarter](https://www.protagx.com/hubfs/AI-Generated%20Media/Images/Paper%20Shadow%20Study.png)](https://www.protagx.com/en/ddd/salesforce-verdient-an-anthropic?hsLang=en)

[ai](https://www.protagx.com/en/ddd/tag/ai), [CRM](https://www.protagx.com/en/ddd/tag/crm), [Hubspot](https://www.protagx.com/en/ddd/tag/hubspot), [Salesforce](https://www.protagx.com/en/ddd/tag/salesforce)

### [Salesforce had a very good quarter](https://www.protagx.com/en/ddd/salesforce-verdient-an-anthropic?hsLang=en)

 August 28, 2026

 Data Divers Dialogs · By Christian Schappeit · August 2026

[Read more](https://www.protagx.com/en/ddd/salesforce-verdient-an-anthropic?hsLang=en)

 Free Guide

### How to increase your Facebook reach by over 200% with this simple trick

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Suspendisse varius enim in eros elementum tristique.

[Download Guide](https://484997.hs-sites.com/lively/contact)

### Subscribe to our newsletter

[![protagx-logo (1024 × 300 px)](https://www.protagx.com/hubfs/logos/protagx-logo%20(1024%20%C3%97%20300%20px).svg "protagx-logo (1024 × 300 px)")](https://protagx.com?hsLang=en)

Christian Schappeit - Unternehmensberatung für Digital Business Consulting und Datenintegration.

Als erfahrener CRM-Integrationsexperte und CMS-Stratege bin ich spezialisiert auf den Einsatz führender CRM-Plattformen wie Hubspot und Salesforce Health Cloud, ergänzt durch leistungsfähige Integrationstools wie Mulesoft. Mein Schwerpunkt liegt auf der Konzeption, Implementierung und Optimierung von datengesteuerten CRM-Systemen, die speziell für Unternehmen im Gesundheitswesen und in der Forschung entwickelt wurden. Ich bringe fundiertes Fachwissen bei der Erstellung und Verfeinerung von CRM-Strategien, der Verwaltung der nahtlosen Integration von CPQ-Prozessen und der Entwicklung effektiver Plattformen für Kunden- und Patientenbeziehungen mit, die die Patientenversorgung und Kundenzufriedenheit verbessern sollen.

#### Pages

- [Home](https://www.protagx.com/en/)
- [About](https://www.protagx.com/de/ueber-uns)
- [Support](https://www.protagx.com/en/support)
- [Contact](https://www.protagx.com/de/kontakt)

#### Resources

- CRM Experts
- Smart Tagging
- Services
- [Blog](https://www.protagx.com/en/ddd)

[Customer Support](https://www.protagx.com/en/support?hsLang=en)

---

- [Terms of Service](https://www.protagx.com/en/terms-of-service)
- [Privacy](https://www.protagx.com/en/privacy-policy)
- [Imprint](https://www.protagx.com/en/imprint)

 follow protagx on social media [Follow us on LinkedIn](https://www.linkedin.com/showcase/protagx) [Follow us on Twitter](https://x.com/protagxcom) [Follow us on Facebook](https://www.facebook.com/protagx) [Follow us on Facebook](https://www.instagram.com/instaprotagx) [Follow us on Facebook](https://www.youtube.com/@protagx)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Christian Schappeit",
    "url" : "https://www.protagx.com/en/ddd/author/christian-schappeit"
  },
  "dateModified" : "2026-10-26T09:01:39.558Z",
  "datePublished" : "2026-10-23T17:20:27.000Z",
  "headline" : "We don't run PHP. Your website does.",
  "image" : [ "https://www.protagx.com/hubfs/Neon%20Server%20Stack%20Under%20Siege.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://www.protagx.com/en/ddd/we-dont-run-php-your-website-does",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://www.protagx.com/hubfs/protagx-logo%20(1024%20%C3%97%20300%20px).svg"
    },
    "name" : "protagx Inh. Christian Schappeit"
  }
}
```