Skip to content
  • There are no suggestions because the search field is empty.

Understanding the PHP Security Update

In this article, we’ll explain how the recent PHP security update relates to your Forge website and answer common questions. 

In October 2026, a security update was released for PHP, a programming language that runs a large share of the internet's websites. We know news about security updates can raise questions, so in this article we'll explain what happened, how it relates to Agency Revolution Forge, and answer common questions.

In this article, we will be covering the following:

What is PHP, and what happened?

On October 20, 2026, two critical vulnerabilities in PHP were made public (CVE-2026-109618 and CVE-2026-109619, also known as “PHP2Shell”).  If left unpatched, these vulnerabilities could put websites running PHP at risk.

The PHP security team released a fix on October 21, 2026, and organizations like the FBI encouraged anyone running PHP to apply the update promptly.

How We Protected Your Forge Website

Forge websites run on servers managed by our hosting partners. We have proactive systems in place to watch for security updates like this one, and we were already working with our hosting providers on the morning of October 21 to apply the updates to Forge sites.

Our hosting partners applied the patched version of PHP to all Forge websites on October 21. Once the update was complete, our team checked Forge websites across each PHP version we support and confirmed the patch was in place.

Your Forge website has already been updated, and no action is required on your part. There was no impact to any Forge website and no downtime.

💡 No changes to your website are needed. Your website continues running as usual.

What About Other Agency Revolution Products?

Agency Revolution Fuse uses different technology, not PHP, and is not affected by these vulnerabilities. No action is needed for your Fuse account.

Frequently asked questions

Does my Forge website use PHP?
Yes. Forge websites are built on WordPress, which uses PHP.

Has my website been updated?
Yes. Our hosting providers have applied the update to all Forge websites.

Was my website impacted, or did it go down?
No. The update was applied with no impact and no downtime.

Do I need to update anything on my website?
No. No action is required from you.

Is Fuse affected?
No. Agency Revolution Fuse doesn’t use PHP, so this update does not affect it.

Where can I learn more?

For more information about our security policies, procedures, and practices, visit our Trust Center. If you have questions that aren’t covered here, contact us at (800) 606-0477 or team@agencyrevolution.com. We’re here to help!