The Layershift Logbook

• A global Microsoft outage has hit email and Teams. If you're affected, wait until it's over before you switch providers.
• Dedicated email providers usually have fewer moving parts, and fewer customers affected by any one fault. No provider is immune.

Black Friday falls on 27 November this year. Perhaps a marketing campaign is about to go live, or a post about your business has just gone viral. More visitors can be great news, but only if your website can cope with them.

PHP published fixes for the PHP2Shell vulnerabilities on 21 October 2026. Customers with Imunify360 installed on their managed VPS had already received new firewall rules that blocked the known attack before PHP’s fixes became available. No Layershift customers are known to have been affected.

Security status update for Layershift customers

Last updated: 27 October 2026, 19:22

What happened?

On 21 October, the PHP development team released emergency fixes for two critical vulnerabilities (php2shell), CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10.

You won't realise it at the time, but the hundreds of decisions you silently make (or these days, maybe your AI agent makes on your behalf?) when starting a new project determine how painful you'll find the inevitable security patching it needs throughout the rest of its lifetime.

Five hours. That is the activity-weighted median time from disclosure to first exploit that Patchstack recorded in 2025 for the WordPress vulnerabilities attackers targeted most heavily (Patchstack, State of WordPress Security in 2026).