ALERTCritical PHP vulnerability · CVE-2026-109618 · CVE-2026-109619 · 21 Oct 2026
<?doiusephp?>

Is Squarespace affected by the PHP security issue?

No.

No action needed for the website itself. Squarespace hosts your website on its own fully managed platform, so there's no PHP for you to update. Check the other systems you run yourself.

Check your website

Run a free check on your website, or on other sites and tools you use.

What to check

  1. 01

    Think beyond your main website

    Webshops, booking systems, intranets, customer portals and subdomains (like shop. or blog.) can run on different software. Check those too.

  2. 02

    Check other products you use

    Some appliances and software packages include PHP. The Dutch NCSC keeps a list of affected products; watch for updates from your vendors.

Good to know

  • Hosting is included in every Squarespace plan. Source ↗
  • Squarespace provides fully managed hosting and monitors for threats and vulnerabilities around the clock. Source ↗
  • A separate website, shop or tool you use next to Squarespace may still run on PHP.

Questions & answers

Do I need to do anything for my Squarespace website?

Not for the website itself: Squarespace manages the platform it runs on. Do check any other websites or systems you run yourself.

What about tools I've connected to Squarespace?

Connected services run on their makers' own systems. If one is critical to your business, it's reasonable to ask its maker whether they're affected.

More: How to check if your website uses PHP · The October 2026 PHP security issue, explained

Other platforms: WordPress · WooCommerce · Joomla · Drupal · Magento · PrestaShop · TYPO3 · Shopify · Wix

SOURCES