This week an international alert was raised over two critical vulnerabilities in PHP, the language that powers millions of websites, including every site built on WordPress. It has been issued by the US NSA and FBI and, in Spain, by Incibe, and several European governments have temporarily taken their websites offline as a precaution, as [reported by RTVE](https://www.rtve.es/noticias/20261022/fallos-criticos-php2shell-vulnerabilidades-servidores-alerta-ciberseguridad/17277748.shtml).
If your website is on aMarte, you are not exposed to this flaw: our websites do not run on PHP.
What happened
The two flaws, known as PHP2Shell, are CVE-2026-109618 and CVE-2026-109619. Both score 9.2 out of 10 on the CVSS v4.0 scale. They allow code to be run on a server remotely and without logging in, so an attacker could access files and databases or alter the website. One comes from memory handling errors on certain requests and the other from the system reusing internal information that is not refreshed between one request and the next.
The risk is especially high on servers running Apache with mod_php, although there are also attack routes with PHP-FPM depending on the setup. Incibe has warned that attacks were already recorded before the updates were published.
Why it has had so much impact
PHP is present on about 70% of the websites where the language can be identified, and it is the foundation of WordPress, which powers around 40% of the sites on the Internet. One unfixed vulnerability puts a huge number of servers at risk at once. That is why Germany, France, Belgium, Finland and Czechia have taken public pages offline as a precaution while they applied the patches.
Why your aMarte website is not exposed
aMarte websites and stores are built with JavaScript-based technologies, such as Next.js and Astro, and are served from our provider's cloud infrastructure. There is no PHP in them, and no Apache server with mod_php or PHP-FPM for an attacker to exploit with these flaws. You do not have to install or update anything yourself either, because we maintain the platform.
This does not mean a website is free of risk in general: any software can have vulnerabilities, which is why we closely follow the alerts that affect our platform.
What you need to do
If your website is on aMarte, nothing for this alert. If you maintain another website on WordPress or other PHP software, for example a previous website or a blog on other hosting, the agencies recommend the following:
* Check which PHP version each server uses and update as soon as possible to a fixed version. * Watch for unusual behavior, such as PHP processes opening command terminals or downloading files unexpectedly. * If you cannot update a server exposed to the Internet, isolate it from the public network until it is protected.
If you would like us to review your previous website or consider migrating it to aMarte, write to us and we will go through it with you.