On October 21, 2026, a major security flaw was found in PHP. If that name doesn't ring a bell, that's normal: PHP is the technology that runs a large share of websites, a bit like the engine of a car. You never see it, but everything depends on it.
The flaw, nicknamed "PHP2Shell," lets someone take control of a website remotely, without a password. And it's already being exploited. In short: it's worth taking five minutes to check your tools.
HubSpot doesn't run on PHP. Your CRM, emails, forms, workflows, pages and HubSpot blog are safe. There's nothing for you to do there.
The question to ask yourself: do I have a website or web tool that isn't on HubSpot? For example:
A simple trick to find out if your site runs on WordPress: add /wp-admin to the end of its address (for example, yoursite.com/wp-admin). If a WordPress login page shows up, you have your answer.
And if you don't know who hosts your site, look through your invoices: GoDaddy, Bluehost, OVH, Hostinger, a web agency… That's the person or company who can fix this.
Here are the PHP-based tools we come across most often. The list isn't complete: when in doubt, ask your provider.
Websites: WordPress, Drupal, Joomla, Craft CMS, TYPO3, Concrete CMS, Statamic, Kirby, ProcessWire, MODX, Silverstripe, Tiki Wiki, among others.
Online stores: WooCommerce, Magento (Adobe Commerce), PrestaShop, OpenCart, Shopware.
WordPress plugins: Gravity Forms, the HubSpot plugin for WordPress, and all the others. They're affected because the site that hosts them is.
Training: Moodle, Chamilo, Claroline.
CRM and management: SugarCRM and SuiteCRM (when installed on your own servers), CiviCRM, Vtiger, Dolibarr, Akeneo, Pimcore.
Email and surveys: Mautic, phpList, Sendy, LimeSurvey.
Web analytics: Matomo (formerly Piwik), when installed on your own servers rather than its cloud version.
Hosting tools: cPanel, Plesk, phpMyAdmin and webmail like Roundcube. Your hosting provider mostly takes care of these.
Custom development: a site or connector built by a developer with Laravel or Symfony, for example a script that sends data from your website to another system.
One caveat: a tool that isn't affected can still be connected to one that is. For example, a WooCommerce store connected to your CRM. It's the store you need to check.
Updating WordPress isn't enough. To go back to the car: updating WordPress is like a new paint job. Here, it's the engine that needs fixing, and that happens on the server, through your hosting provider or whoever manages your site.
The easiest way: send them this message as is.
Hi,
Can you confirm that our site's PHP version is patched against the "PHP2Shell" vulnerability (CVE-2026-109618 and CVE-2026-109619)? The patched versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Thanks!
If they tell you your site runs on a version older than PHP 8.2, plan an upgrade. Those versions are no longer maintained, and some won't get a fix.
And if one of your affected tools is connected to HubSpot, we can rotate the connection key once the fix is in. Just as a precaution.
Don't know what your tools run on? No problem, that's what we're here for. Email us at domenique@guepard.ca and we'll look into it with you.