PHP2Shell: Capacity Vault does not use PHP

Written by Oliver Asha, Solicitor & TEP
Published: 22 October 2026

On 21 October 2026 the people who make PHP released emergency fixes for two critical security flaws, now known as "PHP2Shell" [1]. Capacity Vault does not use PHP. Not on our website, not in your account, and not in the systems behind it. These flaws cannot reach your recordings or your details, and you do not need to do anything.

Below we explain what PHP2Shell is, how Capacity Vault is built, and what to check if you run a website of your own.

What is PHP2Shell?

PHP is a programming language that runs on a great many web servers. WordPress, the most popular way to build a website, is written in it.

The two flaws, numbered CVE-2026-109618 and CVE-2026-109619 [2], are in PHP itself. So a website can be at risk even if its own code has no mistakes. PHP says they "can allow unauthenticated remote code execution" [1]. In plain English: someone who has not logged in could make the server run commands of their choosing. That can mean reading its data or taking it over.

  • How serious? PHP rates both flaws 9.2 out of 10 [4].
  • Who is affected? Wiz, whose researchers reported the flaws, says "every PHP version released in the last decade" is affected by at least one of them [5]. They showed an attack working against an up-to-date WordPress site [5].
  • Is anyone using it? Amazon recorded an attempt to use the flaws on 17 October 2026, four days before they were made public [3]. Amazon now says they are "being broadly exploited in the wild" [4].
  • What is the fix? PHP's advice is to "update immediately" to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35 [1]. It says "there are no complete mitigations, updating is the only safe choice" [1].

The UK's National Cyber Security Centre is reported to be urging organisations to "consider taking offline any system that can't be fixed right away" [3].

Does Capacity Vault use PHP?

No. Capacity Vault has three parts, and none of them uses PHP.

  • This website. Every page is built in advance and stored as a plain file on Amazon Web Services. When you visit, the server sends you the finished page. No program runs on it, so there is nothing for a flaw like this to attack.
  • Your account. The app you log in to at record.capacityvault.co.uk runs in your own web browser. It is delivered as plain files in the same way.
  • The systems behind your account. When the app saves a recording or checks your login, it talks to our own systems on Amazon Web Services. They do not use PHP either.

Until August 2026 this public website ran on WordPress, which does use PHP. We replaced it with the plain-file site you are reading now. Your account and your recordings are kept in a separate system, which does not use PHP.

Does that make Capacity Vault safe from everything?

No website can promise that, and we do not. What we can say is that PHP2Shell is a flaw in PHP, and Capacity Vault does not run PHP. This particular flaw has nothing to attack.

What should you do?

  • If you use Capacity Vault. Nothing. Your account and recordings are not affected.
  • If your firm has its own website. Many solicitors' and will writers' websites run on WordPress. Ask your web developer or hosting company today whether your site runs PHP, and if it does, whether it has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
  • If your site runs PHP 8.1 or older. There is no official release for those versions, only partial fixes for PHP 7.4 to 8.1 [4]. Ask about moving to a supported version.

If you have any questions about how we look after your recordings, please get in touch.

This article reflects the sources available on 22 October 2026. The situation may change as more is learned about these flaws.

Sources

  1. Security advisory: critical remote code execution vulnerabilities, update now, 21 October 2026, on php.net
  2. CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), PHP security advisories on GitHub
  3. PHP2Shell: Critical PHP vulnerabilities patched, update now!, 21 October 2026, on Help Net Security
  4. PHP2Shell (CVE-2026-109618, CVE-2026-109619): frequently asked questions, 21 October 2026, on Tenable
  5. PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, 21 October 2026, on Wiz
Oliver Asha, Solicitor and TEP, founder of Capacity Vault

Oliver Asha

Solicitor · TEP · Founder of Capacity Vault

Oliver is a Solicitor of England and Wales (SRA number 372772) and a Trust and Estate Practitioner (TEP). He qualified in 2006 and founded Capacity Vault Limited, the company behind both Capacity Vault and Make a Will. He also founded Make a Will Online and Digilegal Trustees. He built Capacity Vault after watching his own family struggle to arrange a capacity assessment. He is the named author of the guides and articles on this site.

Verify Oliver’s credentials: Law Society · SRA register · STEP directory

View Oliver’s author profile