This week the PHP project released emergency security updates for two critical vulnerabilities, widely reported as "PHP2Shell". Because they affect so many websites, we want to give our clients a clear answer: EventNook is not affected. The EventNook platform does not use PHP, and there is nothing you need to do.
What happened
- On 21 October 2026, PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619.
- Both are rated critical. They can let an attacker run their own code on a web server that runs PHP, without logging in. PHP says every installation that serves web requests is at risk.
- The US Cybersecurity and Infrastructure Security Agency (CISA) has urged organisations to patch immediately, and security researchers have reported attempts to exploit the flaws.
What this means for you
- No action is needed for your EventNook account, events, registrations, attendee data, check-in or badge printing.
- If your organisation runs its own websites on PHP, for example on WordPress, Drupal or Magento, ask your IT team or hosting provider to confirm that PHP has been updated.
How we look after security
EventNook is ISO 27001 certified. We follow security advisories for the software we use and apply fixes promptly. If you have a question about this update, or need a written confirmation for your own vendor review, email us at support@eventnook.com.
Sources: PHP security advisory and CISA alert, both 21 October 2026.