This article explains how the PHP2Shell security vulnerability, disclosed on October 21, 2026, affects Duda websites. Duda is closely monitoring developments and their potential implications.
The Duda website-building and hosting platform does not use PHP to execute or serve customer websites. Therefore, Duda-hosted websites are not directly affected by PHP2Shell through Duda's core hosting infrastructure.
As part of our ongoing security practices, we are also reviewing relevant third-party components and dependencies used within our platform to identify any potential exposure and take appropriate action where necessary.
Duda websites may include third-party integrations such as job boards, calendars, review widgets, or other externally provided services.
These integrations may operate on infrastructure managed by their respective providers, potentially using PHP or other technologies independently of Duda.
While the use of such integrations does not make Duda's underlying hosting infrastructure vulnerable, we recommend that customers:
-
Review any externally hosted components or custom integrations used on their websites.
-
Contact relevant third-party providers to confirm whether their services are affected and whether security updates have been applied.
-
Update any PHP-based applications or components under their control in accordance with the official PHP security advisory.
If you operate or rely on externally hosted PHP-based applications or services, ensure that the underlying PHP runtime has been updated to a patched version, or obtain confirmation from the service provider that the vulnerability has been addressed.
Duda maintains an established vulnerability management program supported by security monitoring, vulnerability assessment, and remediation processes.
As a fully managed SaaS platform, Duda centrally manages its infrastructure and software updates. This enables us to deploy security patches and other protective measures without requiring customers to manually update the Duda platform or their hosted websites.
We will continue monitoring this vulnerability and take appropriate action if any impact on Duda-managed services is identified.
For further technical details and remediation guidance, please refer to the official PHP security advisory.