Is Umbraco Vulnerable to the PHP Cybersecurity Flaw

Umbraco is not vulnerable to the PHP flaw exposed on 21st October 2026

Umbraco is built on Microsoft .NET and does not use PHP, so the current PHP crisis, caused by the PHP2Shell vulnerabilities, does not affect Umbraco websites or applications. If your site runs on Umbraco, the core platform is not exposed to this issue.

The one area worth checking is anything connected to your site that runs on PHP. That could be a knowledge base, training platform, booking system or blog run by a third-party supplier. We explain what to look for, and what NXT is already doing for our clients, below.

What is the PHP crisis, and why is it serious?

PHP2Shell is the name for two critical flaws in PHP itself (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10, and both can let an attacker run code on a web server without logging in. Because the flaws sit in PHP rather than in any one plugin or theme, a site can be exposed even when its own code is well written.

PHP released fixes on 21 October 2026 in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Older versions of PHP, including PHP 7 and 8.1, are out of support and receive no official fix.

The National Cyber Security Centre has told UK organisations to update immediately. Where that isn't possible, it advises considering taking systems offline. Security firms have already reported exploitation attempts. Several organisations, including Dutch government websites and the HR software provider BambooHR in some regions, took services offline as a precaution.

WordPress, Joomla and other PHP platforms are most at risk

Any website or application running on PHP is potentially exposed, whichever CMS sits on top. That includes some of the web's most widely used platforms:

• WordPress, including WooCommerce shops

• Joomla

• Drupal

• Magento (Adobe Commerce) and PrestaShop

• Moodle, and many forum, help desk and booking tools

Researchers at Sansec have already confirmed working attacks against Magento and ten other PHP applications.

Crucially, updating the CMS, theme or plugins does not fix this. The fix is updating PHP on the server itself. Sites on older hosting running PHP 7 or 8.1 have no official fix at all, so they need a server upgrade or emergency protection now.

If you run one of these platforms, ask your host or web partner today which PHP version your site uses and whether it has been patched.

Why Umbraco and .NET aren't affected

Umbraco runs on ASP.NET Core, Microsoft's web framework, not on PHP. There is no PHP interpreter in an Umbraco application for this flaw to reach, so PHP2Shell simply doesn't apply.

That is not luck. It reflects why we recommend .NET and Umbraco for business websites and applications:

• Backed by Microsoft. .NET is maintained by Microsoft, with security updates released on a regular monthly cycle and long-term support versions with clear end dates.

• A security-focused CMS. Umbraco HQ publishes security advisories and long-term support releases, so you always know which versions are supported and for how long.

• Built for business applications. .NET is designed for everything from websites to client portals, integrations and APIs, which is why it is trusted by enterprises, banks and public bodies.

• Flexible without the plugin sprawl. Umbraco is built to be extended with custom .NET code, so business sites rely less on large numbers of third-party plugins, a common route for security issues on other platforms.

• No platform is immune to every future vulnerability. What keeps a site secure is running a supported version and applying updates promptly. That is exactly what our Umbraco support and maintenance plans are designed to do.

Where PHP could still touch your site

Your Umbraco site may be safe, but most business websites connect to other tools and services. Some of those may run on PHP, and their suppliers may be patching them, restricting access or taking them offline right now, sometimes without telling you.

Common examples to check:

• Knowledge bases and help centres linked from your navigation or footer

• Training and learning platforms, such as a Moodle-based learning portal

• External Blogs or microsites on a subdomain, such as a WordPress blog

• Booking, events or membership systems your site links or hands off to

• Embedded forms, widgets or feeds pulled in from another provider

• Other applications on the same server as your website, such as an old admin tool

If one of these goes down, your Umbraco site keeps running, but visitors may hit a broken link, a missing form or an empty widget. Nobody wants to discover that from a customer complaint.

Our advice: run a quick testing session on your site

Set aside 30 minutes to click through your site as a customer would, focusing on anything that connects to another system:

1. Test every form: contact, enquiry, newsletter and registration. Check the confirmation emails arrive.

2. Log in to any client portal, member area or account section.

3. Follow links to external tools: knowledge base, training platform, booking system, careers site.

4. Check embedded content: chat widgets, reviews, maps, video, feeds and search.

5. Visit any subdomains or microsites that sit alongside your main site.

6. Test checkout, payments or bookings end to end, where you have them.

7. Ask your key suppliers two questions: does your service use PHP, and has it been patched to a fixed version?

If anything has stopped working or looks different, note it and let your web partner know. It may be a supplier quietly restricting a service while they patch.

What NXT is doing for our clients

If you're an NXT client, you don't need to do this alone. We started reviewing client websites and applications as soon as the advisory was issued:

• Confirming platform status. Checking every Umbraco and .NET site we support, and confirming no PHP is running alongside it on the same hosting.

• Mapping integrations. Identifying the third-party tools and services connected to each site, and flagging any that rely on PHP.

• Testing key journeys. Running through forms, logins and integrations to catch anything a supplier may have switched off.

• Telling you about any risk. Where we find something that needs attention, we'll contact you directly with what we found and what we recommend.

Not an NXT client, or running a PHP-based site and unsure where you stand? Get in touch and we'll help you assess your exposure and plan next steps, including a move to a supported, secure .NET and Umbraco platform.