Webflow and PHP2Shell: Why Webflow Websites Are Not Affected

Short answer: No, Webflow is not affected by PHP2Shell. Webflow does not run its core services on PHP and confirmed this in its own Trust Center on October 21, 2026. If your website runs on Webflow, there is nothing to patch and no reason to take it offline. Systems running alongside Webflow can still be affected, for example a WordPress shop on a subdomain.

A note on timeliness: PHP2Shell is a breaking story. New information keeps coming in. This article reflects the situation as of October 23, 2026 and may soon be out of date. The linked official sources always take precedence. That is why every screenshot shows the date and time it was captured.

Is Webflow Affected by PHP2Shell?

No. In an entry dated October 21, 2026, Webflow's security team states in the Webflow Trust Center:

"Webflow’s core services are not built on PHP and are not affected. […] No action is required from customers."

Webflow's core services include everything Webflow itself operates and delivers:

• your published website on Webflow hosting
• the Webflow CMS with all collections and content
• Webflow forms, including file uploads
• language versions served through Webflow Localization, for example under /en or /fr

For completeness: according to the same statement, Webflow is still assessing internal, non-production systems that use PHP. Webflow says this requires no action from customers.

What Is PHP2Shell?

PHP2Shell is the name for two critical vulnerabilities in PHP itself: CVE-2026-109618 and CVE-2026-109619. The PHP team rates both at 9.2 out of 10 (CVSS 4.0). They allow attackers to run their own code on a web server without logging in. The flaws sit in the PHP interpreter, not in WordPress, a plugin or a theme. That is why every common way of running PHP for web requests is affected: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.

On October 21, 2026, the PHP project released the patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4, 8.0 and 8.1 only received source-code fixes for people who compile PHP themselves. These versions no longer get regular updates. The PHP team is clear that there is no complete mitigation without updating (security advisory on php.net).

Amazon Threat Intelligence observed a first exploitation attempt as early as October 17, four days before public disclosure (Help Net Security).

How Serious the Situation Is

The impact was visible within hours. The tech press warned of a critical flaw, and government agencies, universities and hospitals took their websites offline as a precaution.

In Düsseldorf, the city, Heinrich Heine University and the university hospital went offline (t-online).

In Berlin, the official city portal berlin.de, Charité hospital, Freie Universität and the Berlin police online station were affected (Zeit Online with dpa).

Websites around the world went offline for emergency updates as well (Malwarebytes). Why so many operators took this step is covered in detail in our article PHP Security Vulnerability PHP2Shell: Why Hundreds of Websites Went Offline.

Webflow and PHP: Why No PHP Runs on Webflow

People searching for "Webflow PHP" usually want to know one of two things. Does Webflow run on PHP? And can I use PHP in Webflow? The answer to both is no.

Webflow itself does not run on PHP. Webflow serves your website through its own managed hosting, built on Amazon Web Services and Cloudflare's global network (Webflow Hosting). When someone opens a page, there is no PHP process an attacker could reach through PHP2Shell. That is exactly what the Trust Center statement confirms.

You cannot embed PHP in Webflow. The Code Embed element and the custom code fields in page and site settings only accept HTML, CSS and JavaScript. The Webflow help article on Code Embed states explicitly that server-side languages such as PHP, Perl, Python or Ruby do not run there. If you need a PHP script, it has to run on a separate server.

Webflow Cloud does not use PHP either. Webflow Cloud lets you run your own applications next to your website. They are built with Next.js, Astro or Vite and run on Cloudflare Workers, which means JavaScript (Webflow developer documentation).

Where PHP Can Still Hide: Systems Around Webflow

"Webflow is not affected" applies to everything Webflow delivers. Many companies, however, run other systems next to their Webflow website. When we reviewed our clients' projects on October 22, the risk was never Webflow. It was always one of these systems next to it. Typical examples:

• Shops and blogs on subdomains, such as a WooCommerce shop at shop.your-company.com or an older WordPress blog
• Booking and registration systems running as a WordPress installation with a form plugin
• Forms with a custom action that send data to a PHP script on another server instead of to Webflow
• Old landing pages and redirect domains still sitting with a previous hosting provider
• Translation services with their own subdomain, where the language version is served from the provider's servers. Only the provider can tell you what technology runs there. We asked Weglot: Weglot and PHP2Shell.

For every one of these systems: updating WordPress or its plugins does not close the vulnerability. Your hosting provider has to update PHP on the server. WordPress maintenance mode does not protect you either, because PHP keeps running. And firewall rules like the ones Vercel rolled out in advance do not replace the update. Vercel says so itself (Vercel security bulletin).

How to Check Your Setup in Five Minutes

1. List all domains and subdomains. Your domain registrar's DNS settings show the complete list. Entries that everyone has forgotten about often turn up there.
2. Tick off your Webflow domains. Every domain listed in Webflow under Site settings, Publishing runs on Webflow and is not affected.
3. Ask your hosting provider about all the others. What matters is the PHP version actually running, not the one selected in the control panel. Versions patched against PHP2Shell are 8.2.35, 8.3.36, 8.4.27 and 8.5.12 or later. See the update right below this list.
4. Check forms and embedded code. If a form action or a script in a Code Embed points to an address ending in .php, that server belongs on your list.
5. On PHP 8.2, plan your next upgrade now. PHP 8.2 receives no security updates after December 31, 2026.

Update, October 23, 2026: The PHP team has published a further notice. There is an additional attack path (CVE-2026-115560) that the team itself considers unlikely. It only occurs with an unusual combination of configuration and application code. Until the next regular PHP release, the PHP team recommends setting "session.upload_progress.enabled=0". If you already applied this as a mitigation on October 21, no further action is needed (notice on php.net). Nothing changes for Webflow websites, because no PHP runs there.

Important: These five steps give you a first overview. They do not replace a professional security review. Have your setup checked by a professional now, for example your hosting provider, your IT service provider or us. That is the only way to be truly on the safe side.

What This Means for Choosing a Website Platform

We have been building websites with Webflow since 2017. On October 21, 2026, our clients had nothing to do for their Webflow websites: no emergency patch, no maintenance window, no shutdown. The work was in the systems next to them.

That does not make Webflow invulnerable. No system is. But responsibility for servers and runtime lies with Webflow, which has its own security team. With a self-hosted PHP website, it lies with the site owner, often without in-house IT security. How the two approaches differ day to day is covered in our Webflow vs. WordPress comparison.

Want to find out whether PHP systems are running next to your website, or considering a move to Webflow? Book a short call with us. Learn more about our work on our Webflow agency page.

Sources

As of October 23, 2026. We retrieved all sources on October 22, 2026 and checked the information from Webflow and the PHP project again on October 23, 2026. The screenshots in this article show the date and time they were captured. The situation is still developing, and the official sources always take precedence. This article does not replace a security review of your specific setup.

Official sources

• Webflow Trust Center: "PHP2SHELL vulnerabilities statement", October 21, 2026
• PHP project, php.net: "Security advisory: Critical remote code execution vulnerabilities, update now", October 21, 2026
• PHP project, php.net: "Upcoming Critical PHP Security Release", October 20, 2026 (CVSS 4.0 rating)
• PHP project, php.net: "PHP 8.2.35 Released!", October 21, 2026 (end of security support for PHP 8.2)
• PHP project, php.net: "Informational advisory: Session upload progress", October 23, 2026
• Webflow Help Center: "Custom code embed"
• Webflow: "Website Hosting"
• Webflow developer documentation: "Optimizing your app for Webflow Cloud"
• Vercel: "PHP security advisory: php2shell (CVE-2026-109618, CVE-2026-109619)", October 21, 2026

Reports

• Help Net Security: "PHP2Shell: Critical PHP vulnerabilities patched, update now!", October 21, 2026
• heise online (German): "php2shell: Critical vulnerabilities allow code injection in PHP", October 21, 2026
• t-online (German): "Düsseldorf: city, university and hospital go offline over IT warning", October 21, 2026
• Zeit Online with dpa (German): "Websites switched off over security flaw", October 21, 2026
• Malwarebytes: "PHP2Shell: Why many websites had to go offline for emergency security updates", October 21, 2026