10/21/2026
News reports about a critical PHP vulnerability called PHP2Shell have raised understandable questions about website security. We want to share what we know and explain what it means for clients whose websites we host on Pressable.
PHP is the underlying programming language used by WordPress and many other websites. The reported vulnerabilities affect PHP itself, rather than a specific WordPress plugin or theme. If exploited, they could allow an attacker to run code on an affected server. The PHP project has released security updates to address the issue.
Automattic, Pressable’s parent company, says sites hosted on Pressable are protected against PHP2Shell and site owners do not need to take action at this time. We’ve reviewed the update and are monitoring for further guidance. We’ll let clients know if anything changes.
As part of our hosting services, Esquire Interactive manually reviews and updates plugins, themes, and other components associated with hosting. This ongoing maintenance helps keep client websites current. PHP security updates are managed at the hosting-platform level, so we’re also monitoring Pressable’s guidance on those updates.
For now, clients whose sites are hosted on Pressable do not need to make changes because of PHP2Shell. Keeping WordPress, themes, and plugins up to date remains a good security practice, but those updates are separate from the PHP runtime fix addressed by the hosting provider.
For more information, see the USA TODAY report (https://lnkd.in/eGUzWhTh), Automattic’s update (https://lnkd.in/erZSWgBa), and Pressable on X (https://x.com/Pressable).
