PHP2Shell: 24social websites are not affected
Two critical PHP vulnerabilities were disclosed on 21 October 2026. Nothing on 24social runs PHP, so every Enterprise and My Place website is safe.
On 21 October 2026, the PHP project released emergency fixes for two critical vulnerabilities, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). They let an attacker run code on a web server without logging in, and security agencies including CISA and ENISA are urging everyone running PHP to patch immediately.
24social websites are not affected. Nothing on the 24social platform uses PHP: not the CMS, not the websites we run for Enterprise customers, and not My Place. There's nothing you need to do.
What PHP2Shell is
PHP is the language behind a large share of the web, including WordPress, many hosting control panels and plenty of older bespoke websites. The two flaws sit in how PHP handles memory and errors, which nearly every request touches. That's why every PHP installation serving web pages is at risk until it's updated to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and why attackers moved quickly: exploit attempts were seen before the fixes were even published.
Why 24social isn't exposed
Our platform is built on a modern TypeScript stack, with Next.js websites running on managed cloud infrastructure from Vercel, Google Cloud and Cloudflare. There's no PHP runtime anywhere in it, and no web servers of our own for an attacker to reach.
That's a deliberate choice. PHP2Shell is a reminder that how a platform is built matters as much as how quickly it's patched.
Built for security, safety and reliability
Secure by design
- Pages built ahead of time. Most pages are generated in advance and served from a global edge network, so a typical guest visit never reaches an application server at all.
- No servers to patch by hand. Hosting, databases and storage are managed services. Operating system and runtime security updates are applied by the providers as they're released.
- Encrypted throughout. Traffic is encrypted in transit with TLS, and databases and backups are encrypted at rest.
- Credentials kept out of code. API keys and secrets live in managed environment configuration, never in the codebase.
- Protected sign-in. CMS users can turn on two-factor authentication, and we support single sign-on for enterprise teams.
- Independently tested. We commission penetration tests from CREST-accredited security specialists, then fix and re-test any findings.
Safe for your content
- Every change recorded. Revision history and an audit log show who changed what and when, and let you roll a page back.
- Daily backups with point-in-time recovery, so data can be restored to the minute if something goes wrong.
- Approvals where you want them. Place manager mode lets venue teams submit changes for sign-off before they go live.
- Spam and bot protection on website forms.
Reliable when it matters
- Fast on busy nights. Edge delivery keeps pages quick and available through Friday nights, match days and Christmas booking rushes.
- Monitored around the clock. Error tracking, uptime checks, backup checks and automated tests of key guest journeys alert our team as soon as something looks wrong.
- Careful releases. Every change passes automated checks and a preview deployment before it goes live, and can be rolled back straight away.
If you run PHP elsewhere
Plenty of hospitality groups still have a WordPress site, booking plugin or campaign microsite running somewhere outside 24social. If you do, check with your hosting provider or agency today that PHP has been updated, and follow the CISA guidance.
If you'd rather not have to worry about it next time, we can help you bring those sites onto Enterprise or My Place. Get in touch and we'll talk it through.
