Does Make a Will Use PHP? What the PHP2Shell Security Flaw Means for You

You may have seen news this week about a serious security problem called "PHP2Shell". The short answer is that Make a Will does not use PHP. Not on our website, and not in the system we use to keep our clients' files. This problem cannot reach us, and you do not need to do anything.

If you made your will online through our sister service, Make a Will Online, it has published its own update. We explain what it says below.

What is PHP?

Every website lives on a computer somewhere, called a server. When you visit a page, the server sends it to you.

On many websites, the server builds each page at the moment you ask for it, using a program. PHP is one of the most common languages those programs are written in. WordPress, the tool behind a huge number of websites, is written in PHP.

What went wrong?

On 21 October 2026, the team that looks after PHP announced two serious flaws in PHP itself, and released a fix. Security people call a flaw like this a "vulnerability": a weak spot that an attacker can use to get in.

PHP says these two "can allow unauthenticated remote code execution". That is a mouthful, so here it is piece by piece:

• Unauthenticated. The attacker does not need to log in, or have a password.
• Remote. They can do it from anywhere in the world, over the internet.
• Code execution. They can make the server follow their own instructions. That could mean reading the information it holds, or taking it over completely.

It is about as serious as these things get. PHP rates both flaws 9.2 out of 10. Amazon saw someone trying to use them on 17 October, four days before anyone announced them. It now says they are being "broadly exploited in the wild", which means real attacks are happening.

The fix is what is called a "patch". That is an update to PHP which closes the weak spot. PHP's advice is blunt: "updating is the only safe choice".

Does Make a Will use PHP?

No. Here is how each part of Make a Will works:

• Our website. Every page is made in advance and stored as a finished file on Amazon Web Services. When you visit, you are sent that ready-made page. No program runs to build it, so there is nothing for an attacker to take over.
• Booking a call. When you book a call with us, you do it through Google Calendar's booking page. Our website does not collect your details itself.
• Our client files. The system we use to keep track of our clients and their work runs on Amazon Web Services. It is written in a different language, called Node.js. It does not use PHP.

What about Make a Will Online?

When you make a will online from our website, you use Make a Will Online, our sister service. It is run by a separate company, with its own website, and it does use WordPress for some of its information pages.

It has published its own update on PHP. In short, it says:

• Your will is not held in WordPress. In its words: "Your will information is not processed or stored in WordPress."
• It has applied the fix. It "installed the recommended security patches at 11am BST on 22 October 2026".

If you have a question about a will you made with Make a Will Online, please contact its team directly.

Does that mean nothing can ever go wrong?

No website can promise that, and we will not pretend otherwise. What we can say is that PHP2Shell is a flaw in PHP, and we do not use PHP. This particular problem has nothing here to attack.

Do I need to do anything?

• If you are a Make a Will client. No. Nothing about your will or your file has changed.
• If you run a website of your own. Ask your web developer or hosting company today whether it uses PHP. Most WordPress sites do. If it does, ask whether PHP has been updated to version 8.5.12, 8.4.27, 8.3.36 or 8.2.35. A version number is like the edition number on a book: it tells you which copy you have.
• If your website runs an older version. Versions 8.1 and earlier get no official fix. Ask about moving to a newer one.
• If you get an email about this. Criminals often use security news as an excuse to send emails asking you to "log in" or "confirm your details". Do not click the link. Go to the website yourself, or phone the company on a number you already have.

If you have any questions about how we look after your information, please get in touch.

This article reflects the information available on 22 October 2026. The situation may change as more is learned about these flaws.

Sources

• Security advisory: critical remote code execution vulnerabilities, update now, 21 October 2026, on php.net
• CVE-2026-109618, PHP security advisory on GitHub
• CVE-2026-109619, PHP security advisory on GitHub
• PHP2Shell (CVE-2026-109618, CVE-2026-109619): frequently asked questions, 21 October 2026, on Tenable. The source for the 9.2 rating and Amazon's statement that the flaws are being exploited.
• PHP2Shell: Critical PHP vulnerabilities patched, update now!, 21 October 2026, on Help Net Security. The source for the attempt Amazon saw on 17 October.
• PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, 21 October 2026, on Wiz
• PHP security update: what it means for Make a Will Online customers, 22 October 2026, on Make a Will Online