Are Wix, Squarespace and Shopify sites affected by PHP2Shell?
Short answer: the platform handles it. Longer answer: make sure every address your business owns is actually on the platform.
Not by you. Wix, Squarespace, Shopify, Webflow, GoDaddy Website Builder, Weebly and Duda run their own servers and patch them themselves. You can't change the PHP version on those platforms and shouldn't need to. Our checker reports them as “no PHP seen”.
Why hosted platforms are different
On a hosted builder you rent a page inside the platform's system; the servers, the software on them and the updates are the platform's job. Several of these platforms don't use PHP at all, and the ones that do keep it current as a matter of course. PHP2Shell is a flaw in self-managed PHP, the kind that powers a WordPress site on a hosting account. That's where the owner, or the owner's host, has to act.
The one thing still worth checking
Businesses often have more than one site. A Squarespace main site and an old WordPress blog on a subdomain, a Shopify store with a separate landing page someone built years ago, a booking page on different hosting. Each address is its own site. If you have any address that isn't on the platform, check it separately.
Platforms that handle PHP2Shell for you
| Platform | Your action |
|---|---|
| Wix | None |
| Squarespace | None |
| Shopify | None |
| Webflow | None |
| GoDaddy Website Builder (Websites + Marketing) | None (Managed WordPress and cPanel hosting are different: see the GoDaddy guide) |
| Weebly, Duda | None |
| WordPress.com (the hosted service) | None; Automattic maintains the servers. A WordPress site on your own hosting is different. |
Sources
- Shopify security, Squarespace security and Webflow security
- NVD: CVE-2026-109618 and CVE-2026-109619
Common questions
Do Wix, Squarespace or Shopify sites run PHP?
Not in a way you control. These are hosted platforms: the company runs the servers and the software stack and applies security updates itself, so there's no PHP version for a site owner to change.
Is a WordPress.com site the same as a hosted platform?
WordPress.com is a hosted service that manages its own servers, similar to the platforms above. A self-hosted WordPress.org site on your own hosting is different: your host's PHP version matters.
Could anything on a hosted site still be affected?
Other parts of your online presence can be, such as a separate blog, booking system or subdomain on ordinary hosting. Run the PHP vulnerability checker on each address you use.
Part of PHP2Shell: is your website affected, and what to do. Not sure which setup you have? Run the free PHP check and the result tells you.