PHP2Shell: FlowCreates websites are not affected

Updated 27 October 2026

If FlowCreates built your website, PHP2Shell does not affect it. You don't need to do anything.

What PHP2Shell is

PHP2Shell is the name for two critical vulnerabilities in PHP, the programming language behind roughly 70% of websites worldwide. They are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10 for severity. They let an attacker who hasn't logged in run their own code on a web server.

Because the flaws are in PHP itself, any site on a vulnerable PHP version may be exposed, including sites built on WordPress, Drupal and Joomla. Details leaked before the fix was released on 21 October. Amazon Threat Intelligence recorded an exploitation attempt on 17 October, four days before public disclosure, and the NSA advised that sites unable to patch right away should go offline until they were fixed. Government, education and healthcare sites in several European countries were taken down as a precaution.

Why FlowCreates websites are not affected

We build only on Webflow. Webflow's security team has stated on the Webflow Trust Center that its core services are not built on PHP, are not affected by PHP2Shell, and that customers don't need to take any action to protect their Webflow site.

A Webflow-hosted site has no PHP installation for you to maintain, no plugins, and no server to patch. Webflow manages the hosting infrastructure and its security updates. While firms on self-managed PHP were patching under pressure or taking their sites offline, Webflow sites kept running as normal.

What to check outside your website

Webflow's statement covers Webflow. If your business runs a separate PHP application or service that connects to your website, that system needs its own check. Look at:

• Connected systems: a client portal, booking tool or form handler hosted somewhere other than Webflow.
• Your old website: if we moved you from WordPress and the old site is still running on a subdomain or your previous hosting account, it needs updating or shutting down.
• Other company systems managed by your IT provider.

If you're not sure which of your domains run on Webflow, email us and we'll check them for you.

If your firm is still on self-managed WordPress

Ask your host to confirm PHP has been updated to a fixed release: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. A WordPress or plugin update alone will not close the gap. Our guide to what PHP2Shell means for WordPress sites in Malaysia covers what to check this week and the signs of a compromised site.

This week showed who carries the patching work on each platform. On self-hosted WordPress, your team or your host patches PHP, WordPress core and every plugin, often against a live exploit. On Webflow, the platform patches its own infrastructure. Your team still owns account access, team permissions and any third-party scripts added to the site, so keep two-factor authentication on and the script list short.