Is Shopify, Wix or Squarespace Affected by PHP2Shell?

As of 23 October 2026, Shopify, Wix and Squarespace have not published a PHP2Shell statement about their website platforms that we could find. HubSpot and Webflow have said their core platforms are not built on PHP. BigCommerce says it has patched its services. Squarespace took its Acuity Scheduling service offline on 21 October while it applied PHP2Shell fixes, then brought it back the same day.

The direct answer: if your site runs entirely on a hosted builder, there is no PHP on your side of that platform for you to patch. The vendor runs the servers. Your exposure sits in the self-hosted PHP around the platform: a custom app, a headless WordPress front end, an old site on a subdomain, a form handler or an inventory connector on your own server.

PHP2Shell is two critical flaws in the PHP engine (CVE-2026-109618 and CVE-2026-109619), fixed on 21 October 2026. Our explainer covers what PHP2Shell is. This page covers the hosted platforms, platform by platform.

Why Hosted Builders Are Different

On a hosted builder (software as a service, or SaaS) the vendor owns the servers, the runtime and the patching. You own your account, your logins, the apps you connect and any code you host elsewhere. Our guide to the shared responsibility model explains this split in more detail.

That split is why PHP2Shell looks so different here than on a self-hosted WordPress site. On your own server, you had to install fixed PHP and restart it. On a hosted builder, whatever the vendor runs is the vendor's job. The open question is only what you run outside it.

Platform by Platform, as of 23 October 2026

Shopify

We found no Shopify PHP2Shell statement as of 23 October 2026: nothing on its status page, newsroom or developer changelog. That is not a warning sign by itself. Shopify themes are built with Liquid, which Shopify describes as "a template language created by Shopify." Shopify hosts the storefront.

The part to check is apps. Shopify apps run on the developer's own hosting. Shopify's deployment docs say "Your hosting service manages the app's runtime environment." And since August 2026, Shopify publishes official packages for building apps in PHP. So if you, an agency or a freelancer built a private app or a connector for your store in PHP, that server needs the PHP update like any other. It may also hold your Shopify API access tokens, which makes it worth patching quickly. Our Shopify security guide covers the rest of what Shopify leaves to you.

Wix

We found no Wix PHP2Shell statement as of 23 October 2026, and nothing on its status page in the 19 to 23 October window. Wix's trust page says it provides "fully managed, 24/7 site protection." We have no first-party source on which server languages Wix runs, so we won't guess. Either way, Wix manages its own servers, and there is nothing for a Wix site owner to install. What stays with you is covered in our Wix security guide: logins, two-factor authentication, connected apps and any external code.

Squarespace and Acuity Scheduling

We found no Squarespace PHP2Shell statement about its website platform as of 23 October 2026. Squarespace says its Security Operations Center "monitors for threats and vulnerabilities 24/7." We found no first-party page stating which server language Squarespace websites run on, so don't assume either way.

Acuity Scheduling, Squarespace's booking product, is different. Its status page shows emergency maintenance on 21 October. At 12:41 pm Eastern, Squarespace posted: "To protect your data, we've taken Acuity offline while we address PHP2SHELL." It said the flaw "affects popular web software, including tools Acuity relies on," and that "as their patches are released, we deploy them, test them and confirm they've actually closed the gap." At 2:42 pm Eastern: "The emergency maintenance has been completed."

That was a planned precaution, not a reported breach. Squarespace did not say any data was affected. A separate, shorter Acuity outage on the night of 20 October gave no cause and did not mention PHP, so don't link it to PHP2Shell.

BigCommerce (Commerce)

BigCommerce, which now presents itself as Commerce, posted a notice on its trust center: "Commerce has applied emergency patches across all services to address the critical PHP vulnerabilities known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We have found no evidence of exploitation affecting Commerce systems or customer data."

It then splits responsibility clearly: "If you run your own PHP applications, please review any custom PHP solutions, check your third-party integrations for exposure, and apply the PHP patches as soon as possible. If you don't run custom PHP applications, no action is needed on your part at this time."

A common case: a BigCommerce store with a WordPress site in front of it as the headless storefront or blog. BigCommerce documents headless WordPress setups. That WordPress site runs on PHP on its own host, and that host must be patched. Our PHP2Shell guide for WordPress covers how.

HubSpot and Webflow

HubSpot posted on its status page on 21 October: "HubSpot is aware of the recently disclosed PHP security vulnerability. PHP isn't part of HubSpot's infrastructure, and we are not aware of any impact to our platform or customers. We will continue to watch the situation and provide an update if our assessment changes." The same wording appears on its trust center, dated 22 October 02:54 UTC.

Webflow's trust center says: "Webflow's core services are not built on PHP and are not affected. Our security team is assessing non-production related systems that use PHP and taking appropriate steps to address any identified vulnerabilities. No action is required from customers."

For both, the leftover risk is PHP you run that talks to them, such as a PHP form handler or CRM sync that pushes leads into HubSpot.

WordPress.com Is Hosted, Too

WordPress.com runs on PHP, but Automattic hosts it. Automattic's 21 October post says "all sites hosted with Automattic, including those on WordPress.com, WordPress VIP, WP Cloud, Pressable, and Tumblr, are safe. If you run your own servers, update now." A self-hosted WordPress.org site on another host is a different case: it depends on that host.

Where Your PHP Exposure Actually Is

If your main site is on a hosted builder, check for PHP in these places:

• Custom or private apps for your store, especially ones built with Shopify's PHP packages or a PHP framework.
• Integrations and middleware on your own server: inventory or ERP sync, shipping connectors, webhook receivers.
• Headless front ends or blogs on WordPress or another PHP app, on a separate host.
• Old sites left running, such as the WordPress or WooCommerce site you moved away from, still live on a subdomain or an old server.
• Landing pages and microsites built by an agency on a PHP host.
• Form handlers and scripts that post to your CRM or email platform.

Every app you connect extends who you depend on. Our guide to plugin and app supply chain security explains how to keep track of them. For a side-by-side view of how each platform family handles patching, see the most secure website platforms, compared.

What to Do This Week

1. List every domain and subdomain you own, and note what runs on each.
2. For each one not on the hosted platform, find out whether it runs PHP. Our free PHP2Shell exposure check can help with public sites.
3. Ask whoever built your custom apps and integrations where they are hosted and whether PHP has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a patched vendor build.
4. Take old, unused sites offline instead of patching them.
5. On the platform itself, check your account security: two-factor authentication for every admin, removal of former staff, and a review of installed apps.

Conclusion

As of 23 October 2026, Shopify, Wix and Squarespace sites have nothing for owners to patch on the platform itself, and none of those three has published a PHP2Shell statement we could find. HubSpot and Webflow say they are not built on PHP, BigCommerce says it patched, and Squarespace briefly took Acuity offline to apply fixes. The real work is the PHP you run around the platform: apps, connectors, headless sites and forgotten subdomains. Find them, patch them or shut them down. If you want a second pair of eyes on what you run, our website security team can help. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions