Introduction
On 21 October 2026, two critical security vulnerabilities were disclosed in PHP, the technology powering millions of websites, including WordPress, WooCommerce, and custom web applications.
Both vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), received a severity rating of 9.2 out of 10. They could potentially allow attackers to take control of affected servers without needing to log in.
That's a serious problem for any business relying on its website to generate enquiries, process orders, or serve customers.
But something else caught our attention.
While website owners were trying to understand what had happened, infrastructure providers like Cloudflare and Cloudways were already responding. One was blocking malicious traffic. The other was preparing and deploying security patches across its managed servers.
For us at Tiny Edges, this is a useful reminder of why choosing the right technology providers matters, especially when you're working with a small team.
Let's look at what happened, how these providers responded, and what smaller businesses can learn from it.
What Actually Happened with PHP2Shell?
PHP is a programming language that runs behind many websites. If you're using WordPress, WooCommerce, Drupal, or a PHP-based application, your website depends on it.
On 21 October, the PHP development team released emergency updates addressing two vulnerabilities:
- CVE-2026-109618: A problem with how PHP handles memory when it runs out of resources during a request.
- CVE-2026-109619: A problem where PHP can retain invalid memory references between requests.
Both issues could potentially allow attackers to execute malicious code on affected servers. The second could also expose sensitive information.
You don't need to understand how PHP manages memory to understand the business risk.
An attacker who successfully exploits these vulnerabilities could potentially access customer information, modify website files, or disrupt services. The actual impact depends on how the server and application are configured.
And here's something important: updating WordPress and its plugins doesn't fix these vulnerabilities.
The problem exists in PHP itself. That means the PHP environment running on the server needs to be patched.
The PHP development team released fixes for versions 8.2, 8.3, 8.4, and 8.5. Older versions no longer receive official security updates, although some hosting providers offer extended support with additional security patches.
This brings us to how different service providers responded.
How Cloudflare Responded: Protecting Websites Before Attacks Reach Them
Cloudflare is a service that sits between website visitors and the server hosting a website. Among other things, it can help filter malicious traffic before that traffic reaches the server.
On 21 October, Cloudflare announced that it had deployed additional firewall protections against PHP2Shell.
These protections were deployed before the vulnerabilities became public and were made available across both Free and paid plans.
Cloudflare also introduced additional detection capabilities that examine both incoming requests and the responses generated by servers. This helps identify attacks that may not be obvious from the request alone.
Think of it like having a security guard at the entrance to your building.
The guard checks visitors and stops suspicious activity before it gets inside. That doesn't mean nothing can ever go wrong, but it reduces the chances of unwanted visitors getting through.
Cloudflare's Web Application Firewall (WAF) works on a similar principle.
What this means for businesses: If your website is properly configured to use Cloudflare's proxy and the relevant protections are active, it may already have an additional layer of defence against PHP2Shell.
However, there's an important limitation.
A firewall helps block attacks, but it doesn't repair the vulnerability itself. The server still needs to be patched.
That's where the next part of the response comes in.
How Cloudways Responded: Fixing the Problem at the Server Level
Cloudways is a managed cloud hosting provider. Instead of requiring customers to handle all aspects of server administration themselves, it manages important parts of the hosting environment.
When PHP2Shell was disclosed, Cloudways began implementing temporary security measures while preparing to deploy PHP patches across its infrastructure.
According to its incident status updates, Cloudways took several steps:
- 21 October: Notified customers, introduced temporary mitigations, and began preparing security updates.
- 22 October, 01:02 UTC: Confirmed that applications hosted on Cloudways Autonomous had been patched, while updates continued for Flexible.
- 22 October, 07:03 UTC: Reported that most servers had been patched and the rollout was in its final stage.
- 22 October, 10:20 UTC: Confirmed that the security patch rollout was complete across all active servers.
Cloudways also worked with its Extended Long Term Support (ELTS) partners to provide security patches for older PHP versions, including those no longer supported by the official PHP project.
In a follow-up email to customers, Cloudways confirmed that their managed servers had been patched and that no additional action was required from those customers.
That last part matters.
Instead of individual website owners having to figure out how to patch PHP themselves, Cloudways handled the server-level updates across its managed infrastructure.
There are still responsibilities on the application side. A patched server doesn't automatically mean every plugin, integration, or custom feature is secure.
But having a provider actively maintaining the underlying environment removes a significant part of the work from the website owner's team.
Why We Use Both Cloudflare and Cloudways at Tiny Edges
At Tiny Edges, we're a small technical team ourselves.
We work on websites, custom software, integrations, and other digital projects. Like many small businesses, we have to be deliberate about where our time and resources go.
We can't specialise in everything. And we don't think we need to.
For our WordPress projects, we use Cloudways for managed hosting and Cloudflare for web traffic protection.
The two services handle different responsibilities.
Cloudflare helps protect traffic reaching the website. Its firewall can identify and block certain malicious requests before they reach the hosting server.
Cloudways maintains the managed hosting environment. That includes applying relevant server-level security patches, as demonstrated by its response to PHP2Shell.
Tiny Edges handles the website and application work. We focus on development, WordPress maintenance, integrations, testing, and application-level improvements within the scope of each project.
Think of it like running a business from a commercial building.
You don't necessarily need to employ your own electrical engineers, security guards, and building maintenance team. You work with people who are responsible for those areas, while you focus on running your business.
Of course, you still need to maintain your own office equipment and make sure your staff follow proper security practices.
Technology works in a similar way.
Cloudflare doesn't replace Cloudways. Cloudways doesn't replace website maintenance. And neither removes the need for proper application security.
They each cover different parts of the system.
During the PHP2Shell incident, Cloudflare deployed protective firewall rules while Cloudways rolled out server-level patches. These are two important tasks that our small team didn't have to build or execute from scratch.
We could focus on reviewing the situation, checking the providers' updates, and understanding whether any additional work was needed for the websites we maintain.
That's the practical value of choosing services that complement your team's capabilities.
What Smaller Businesses Should Consider When Choosing Tech Providers
This isn't really about whether Cloudflare or Cloudways is the best provider for every website.
Different businesses have different requirements. Some need more control over their infrastructure. Others are better served by managed services that handle more of the technical work.
The important thing is understanding what you're paying for and what responsibilities come with it.
Here are three things worth considering.
1. Look Beyond the Monthly Price
It's tempting to compare hosting providers based on cost, storage, and server specifications.
Those things matter, but they don't tell the whole story.
A cheaper hosting plan may require you to manage server updates, security configurations, and troubleshooting yourself.
A managed hosting plan may cost more, but some of that difference pays for work you no longer need to handle internally.
Ask yourself: If a critical security problem happens tomorrow, who is responsible for fixing it?
If the answer is unclear, that's worth investigating before choosing a provider.
2. Understand What Each Provider Actually Covers
Having multiple services doesn't automatically mean you have complete protection.
For example:
- Your hosting provider might manage PHP and server updates but not WordPress plugins.
- Your firewall provider might block suspicious traffic but not investigate problems inside your application.
- Your website developer might maintain the application but not have responsibility for managing the underlying server.
The problem comes when everyone assumes someone else is handling something.
Before choosing a service, find out which responsibilities it covers and which remain with your business.
That clarity matters more than the number of services you're paying for.
3. Choose Services That Fit Your Team's Capabilities
A business with a dedicated infrastructure team may prefer a self-managed environment where it has complete control.
A small business with no technical staff might be better served by managed hosting and a website maintenance partner.
Neither approach is automatically better.
The right choice depends on your team's experience, available time, budget, and how important the system is to your daily operations.
At Tiny Edges, we make similar decisions for our own projects.
We prefer to spend our time on the development and technical work where we can provide the most value, while relying on suitable providers for specialised infrastructure services.
The goal isn't to outsource everything. It's to be selective about what you handle yourself and what you entrust to others.
What Should You Do If Your Website Uses PHP?
Even if you're already using managed hosting or a service like Cloudflare, it's worth checking that the relevant protections and updates are in place.
Here's where to start.
Step 1: Check Your PHP Version
Ask your developer or hosting provider which PHP version is running on your website.
The official patched releases are:
| PHP version | Patched release |
|---|---|
| PHP 8.5 | 8.5.12 |
| PHP 8.4 | 8.4.27 |
| PHP 8.3 | 8.3.36 |
| PHP 8.2 | 8.2.35 |
For older versions, confirm whether your hosting provider has applied a verified security backport. Otherwise, plan an upgrade to a supported release.
Step 2: Confirm That Security Updates Have Been Applied
If you're using managed hosting, check your provider's security announcements or ask its support team.
For example, Cloudways reported completing its PHP2Shell patch rollout on 22 October 2026.
If you're using self-managed hosting, confirm that your server administrator has installed the necessary patches.
Step 3: Check Your Firewall Protection
If you're using Cloudflare, make sure your website traffic is passing through its proxy and the appropriate WAF protections are active.
Having a Cloudflare account alone doesn't guarantee that every request to your server is protected.
Step 4: Make Sure Your Website Still Works
PHP updates can sometimes affect older WordPress plugins, themes, or custom code.
After patching, test the parts of your website that matter most to your business.
For an e-commerce website, that could mean checking checkout, payments, and order notifications.
For a service business, it might mean checking contact forms, booking systems, and customer logins.
If you have reason to believe the server was exposed before patching, ask your technical team to review relevant security logs as well.
Your First Practical Step: Send your website developer or hosting provider a simple question:
"Can you confirm whether our website is protected against CVE-2026-109618 and CVE-2026-109619, and whether any action is required from us?"
You don't need to know how to apply the patch yourself. But you should know whether somebody has taken care of it.
The Right Partners Make a Difference
Security incidents like PHP2Shell are a reminder that running a business website involves more than keeping its pages online.
There's the application, the server, the network, the integrations, and the people maintaining each part.
For smaller businesses, trying to manage everything internally isn't always practical. And building a large IT team isn't necessarily the answer either.
Sometimes the better approach is choosing reliable services and partners that take care of the areas outside your team's expertise.
The response from Cloudflare and Cloudways is a good example. One helped protect traffic at the edge, while the other handled security patches at the server level.
Neither is a complete security solution on its own. But together with ongoing application maintenance, they provide a more practical approach for a small team.
At Tiny Edges, that's how we think about technology decisions. We don't need to build or manage every component ourselves. We need to understand how the different pieces work together and make sure the right responsibilities are covered.
If you're reviewing your current website setup and aren't sure who's responsible for what, we're happy to have that conversation.
The best setup isn't necessarily the most expensive or technically advanced one. It's the one your business can maintain reliably with the resources you actually have.
This incident was a useful reminder for us too. We're a small team, and we rely on other providers for parts of our own technology stack. Seeing how Cloudflare and Cloudways responded reinforced why those choices matter.