Not our bug, still our problem

Why the .NET / Umbraco world should take the PHP2Shell vulnerability seriously

Two critical PHP flaws put millions of WordPress and other PHP sites at risk this week. Umbraco sites aren’t affected, but in the age of AI no platform can afford to relax. Here’s why .NET is better placed, and what every site owner should do now.

Umbraco · Security

Patch. Shield. Prepare.

On 20 October the PHP project warned of two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. Details leaked before the fix was ready. Patches arrived on 21 October in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and attack traffic was already being reported. Both flaws can let an attacker run their own code on a web server without logging in.

If your website runs on Umbraco, you aren’t affected. Umbraco is built on Microsoft .NET and doesn’t use PHP. That’s no reason to relax, though. This article explains why .NET and Umbraco sites are better placed, and why every platform needs to raise its guard now that attackers are using AI too.

Key takeaways

Umbraco isn’t affectedThe flaws are in the PHP interpreter. Umbraco runs on .NET, so there’s nothing to patch for this one.

Scale attracts attackersPHP runs most of the web, and WordPress is the biggest reason. One flaw opens millions of doors.

Ownership mattersMicrosoft owns .NET and fixes it on a fixed monthly schedule. Umbraco follows closely.

AI shortens the timelineAttackers can turn a published fix into a working exploit far faster than before, on any platform.

Put a shield in frontA web application firewall such as Cloudflare protects you between a flaw being announced and your patch going live.

What happened

Both flaws sit in PHP’s core, in how it cleans up after a request runs out of memory or hits a fatal error. In the wrong circumstances, leftover data from one request can be used to take control of the server. Every PHP installation that serves web pages is at risk, whichever web server it runs under. Palo Alto Networks counted more than 22 million exposed servers, and older PHP versions that are no longer supported won’t get a fix at all.

Why WordPress makes PHP a bigger target

Around 70% of websites run some version of PHP, and WordPress accounts for a large share of them. When one platform runs that much of the web, a single flaw is worth automating. Attackers scan the whole internet in hours. They don’t need to know who you are, only what you’re running.

The plugin ecosystem adds to the risk. A typical WordPress site depends on dozens of plugins from different authors, each with its own approach to updates. Many sites are set up once and left on shared hosting, running whatever PHP version the host chose years ago.

Why .NET is in a stronger position

.NET is owned and maintained by Microsoft. Security fixes go through the Microsoft Security Response Center and are released on a fixed monthly schedule, Patch Tuesday, with emergency releases when needed. On Windows servers, .NET updates can arrive through Microsoft Update alongside the operating system’s own fixes.

Predictable supportEvery .NET version has a published end-of-support date. Long-term support versions get three years of fixes, so you always know where you stand.

Compiled codeApplication code is compiled before it’s deployed. A file uploaded to the server can’t simply be run as code, which closes off one of the most common ways PHP sites are taken over.

One ownerThe runtime, the framework and the Windows web server come from one company, with one of the largest security teams in the world and a great deal to lose.

That doesn’t make .NET immune. In October 2025 Microsoft fixed a critical flaw in ASP.NET Core’s web server. The difference is how quickly the fix arrived, how clearly it was communicated and how easily it could be applied.

How Umbraco keeps up

Umbraco tracks .NET closely. Its long-term support versions line up with .NET’s, so Umbraco 17 runs on .NET 10. Umbraco HQ publishes security advisories openly on GitHub and releases fixes as patch versions, which can usually be applied in minutes without a full upgrade.

If you’re on an older version that no longer gets fixes, read Your Umbraco upgrade, planned in five steps.

Why being smaller helps

Umbraco runs far fewer websites than WordPress. That isn’t a guarantee of safety, but it changes the economics of an attack. Automated attacks go where the numbers are. Umbraco sites also tend to be built by agencies and in-house development teams, use a smaller set of well-maintained packages, and are usually looked after under a support agreement. Fewer sites, fewer plugins and more people watching make for a smaller target.

In the age of AI, every platform is exposed

AI tools now help attackers read a security patch, work out what it fixed and write a working exploit, sometimes within hours. The PHP flaws followed that pattern: details leaked before the fix, and working examples circulated soon after. The gap between a fix being published and attacks starting has shrunk to almost nothing, and that applies to .NET and Umbraco as much as anything else.

Assume every vulnerability will be exploited the day it’s announced, whatever platform you use.

What we do, and what you can do

Put Cloudflare in frontA web application firewall filters attacks before they reach your server. Cloudflare was already seeing and filtering attack traffic for these PHP flaws, and it updates its managed rules quickly after major announcements.

Close the side doorWith Cloudflare in place, block direct traffic to your server’s IP address so attackers can’t go around it.

Patch on a scheduleApply .NET and Windows updates every month, and Umbraco patch releases as they come out. Don’t save them up for the next upgrade.

Stay on supported versionsVersions of .NET and Umbraco that are out of support get no fixes. Plan upgrades before support ends, not after.

Use fewer packagesEvery package is code you have to trust. Remove anything you no longer use.

Lock down the back officeUse two-factor authentication for every editor, and restrict access to the Umbraco back office by IP address or with Cloudflare Access where you can.

Watch and back upMonitor for unusual activity and keep tested backups away from the server, so you can recover quickly if something gets through.

If you run WordPress or other PHP sites

Update PHP now to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or ask your host to confirm they have. If your site runs an older version of PHP that’s no longer supported, there’s no fix, and it’s time to plan a move.

If you’d like a security review of your Umbraco site, help putting Cloudflare in front of it, or advice on moving from an unsupported platform, get in touch.