PHP2Shell just exposed a flaw in 70% of the web. Here's why Wix users had nothing to worry about.
If you heard about a major website security incident this week and quietly wondered whether your site was affected, this post is for you. On October 21, 2026, two critical vulnerabilities in PHP and the programming language that powers roughly 70% of the internet were publicly disclosed. Together, they're being called PHP2Shell, and they allowed attackers to take full control of a website without ever logging in.
If your website runs on Wix, you were not affected. Wix does not use PHP. Your site, your data, and your clients' information were never at risk. But the story behind why is worth understanding, because it changes how you should think about the platform your business runs on.
PHP2Shell gave attackers unauthenticated remote code execution. That means no login required. No password to guess. Just access. For sites running PHP, the exposure was immediate and severe.
What PHP2Shell Actually Was
PHP2Shell refers to two CVEs disclosed simultaneously: CVE-2026-109618 and CVE-2026-109619. The first exploited an out-of-memory corruption flaw in the PHP engine itself. The second took advantage of stale global state that persisted between requests. Combined, they created a path for unauthenticated remote code execution, the most dangerous class of web vulnerability.
What made this particularly alarming was the scope. PHP is not a niche technology. It powers WordPress, Drupal, Joomla, and thousands of custom-built websites. Hosting platforms, government sites, healthcare portals, and e-commerce stores were all in the exposure window while patches were being prepared and deployed.
For website owners running their own servers or relying on hosts to push PHP updates, the race began immediately.
The safest website isn't necessarily the most expensive one. It's the one where security is built into the platform, not bolted on after the fact.
What About Velo and Third-Party Apps?
This comes up often, so let's address it directly.
Velo is Wix's custom coding environment. It runs on Node.js and JavaScript, not PHP. If you have custom Velo code on your site, PHP2Shell did not apply to you. Full stop.
Third-party apps from the Wix App Market are a different conversation. Those apps run on their own servers, managed by their own vendors. If a specific vendor was operating PHP-based infrastructure, that was their responsibility to address, not Wix's and not yours. Your Wix site and your data were not at risk through the platform.
Wix Users, You Can Breathe Easy. Here's Why.
Wix does not run on PHP. It never has. The platform operates on its own proprietary infrastructure, which means PHP2Shell had nothing to touch on your site. No patch needed. No late-night panic. No plugin update you missed.
This is actually one of the reasons I build exclusively on Wix Studio. Security is baked in at the platform level:
SSL certificates, DDoS protection, and infrastructure updates are all handled by Wix
No plugins to patch, no servers to maintain
Fewer third-party dependencies means fewer entry points for vulnerabilities like this one
eCommerce sites and client data stay protected without you having to think about it
It's not something most people talk about when they're comparing website platforms, but moments like this are exactly why it matters.
What This Moment Reveals About Platform Security
PHP2Shell is a reminder that the platform you build on is a security decision, whether you've thought about it that way or not.
A lot of business owners choose a website platform based on price, templates, or what their web designer uses. Almost none of them ask: who is responsible for patching my server? Who monitors for vulnerabilities? What happens when a critical CVE drops on a Friday evening?
On a platform like WordPress, those answers often involve you, your host, and a list of plugins that all need to be updated at different times by different people. On Wix, the answer is Wix.
I wrote about this in depth in Why I Build on Wix Studio: A Web Designer's Honest Take including the real reasons platform infrastructure matters more than most people realize.
The Bigger Picture
This is also a good moment to revisit the conversation around AI-built websites. A site that was spun up quickly with an AI tool and dropped onto a PHP-based host was just as vulnerable as any other PHP site. Speed of launch does not equal security of foundation. I recently wrote about the limitations of AI website builders and the gap between a site that exists and a site that is actually built to protect your business is one of them.
PHP2Shell will not be the last major vulnerability. The question is not whether threats will emerge. It is whether your website's foundation is built to absorb them without requiring anything from you.
If you are a Wix user: it already is.
If your site isn't built on WiX, and you're looking for a secure & sustainable platform, let's talk about it.
~ Jess
