When a business commissions a bespoke CRM, a custom software solution or a new website, the launch date tends to get all the attention. In reality, launch day is where the long term work begins. Every system we build for our clients needs secure hosting, regular maintenance and someone keeping a close eye on the wider security landscape.
At Studio44, we host the bespoke systems and websites we build for our clients on UK based managed hosting. In October 2026, a set of critical PHP security vulnerabilities, widely reported as PHP2Shell, made headlines across the technology press and the mainstream media. It was a useful real world test of how our hosting environment and maintenance approach protect the businesses that rely on us, and this article explains what happened and how our clients were covered.
PHP2Shell is the name given to a group of critical security vulnerabilities affecting PHP, the programming language behind a large share of the web, including WordPress and many bespoke business systems. Because PHP is so widely used, the news generated understandable concern among business owners about whether their own websites and systems were exposed.
Vulnerabilities like this are a reminder that no software stays secure on its own. The language your system runs on, the server it sits on and the code built on top of it all need ongoing attention. The question for any business is not whether a security issue will appear, but how quickly and effectively it will be dealt with when it does.
Our clients are all UK hosted and when PHP2Shell was disclosed, we applied the security patches across our managed hosting platform automatically, with no action needed from our clients. This meant that our client’s websites and systems were secured before the end of the day!
Crucially, the fixes were not limited to the newest PHP release. Our hosting infrastructure backported the patches to every PHP version provided, from legacy PHP 5.3 through to PHP 8.5. That matters because some established business systems still run on older PHP versions for compatibility reasons, and a forced upgrade in the middle of a security scare can cause more problems than it solves.
For our clients, the outcome was simple:
It is worth noting that this protection applies to managed hosting. Businesses running their own unmanaged servers are responsible for patching PHP themselves, which is exactly the kind of risk a managed hosting partner removes.
A fast response with our hosting infrastructure is one layer of protection. Our own maintenance work forms the rest. For the websites and bespoke systems we look after, that includes:
A brochure website going offline is inconvenient. A CRM, job management system or practice management software going offline, or being compromised, can stop a business in its tracks and mean it cannot function or operate. These systems hold customer records, quotes, invoices, engineer schedules and job histories that teams rely on every day.
That is why we treat hosting and maintenance as part of the system, not an afterthought. Our clients range from trades and field service businesses to construction and professional services firms, and each one needs confidence that their data is secure and their system is available when their team needs it. Pairing bespoke software development with secure managed hosting and ongoing support means there is one team accountable for the whole picture, from the code to the server it runs on.
Were Studio44 hosted websites affected by PHP2Shell? No action was needed for the websites and systems we host. Every PHP version on our managed platform, including older versions, was patched as soon as fixes were available.
Do I need to upgrade my PHP version because of PHP2Shell? Not on our managed hosting. The security fixes were backported to older PHP versions, so a system running PHP 7.4 is protected in the same way as one running PHP 8.5. We still recommend planned upgrades to modern PHP versions for performance and long term support.
Where are Studio44 client systems hosted? All client systems are hosted in the UK on managed hosting, with each client in its own hosting package and 30 days of backups.
Can Studio44 host a system you did not build? We can review existing websites and systems and advise on migrating them to our managed hosting, including a check of PHP versions and security updates before the move.
PHP2Shell will not be the last security issue to make the news. What matters is having a hosting environment and a maintenance partner that respond quickly, protect older systems as well as new ones, and keep you informed.
If you would like to talk about hosting, maintenance or support for your website, CRM or custom software system, get in touch with the Studio44 team. We are happy to review what you have today and explain how we would keep it secure.
Insights & resources
When a business commissions a bespoke CRM, a custom software solution or a new website, the launch date tends to get all the attention. In reality, launch day is where the long term work begins. Every system we build for our clients needs secure hosting, regular maintenance and someone keeping a close eye on the wider security landscape.
Studio44 InsightsThe hardest part of commissioning a new CRM is rarely the budget. It is the unknown. Between saying yes and logging in for the first time, what actually happens? Who needs to be involved? How much time will it take from your team? Most businesses have never done this before, and a vague process is often what puts them off.
Studio44 InsightsSome businesses do not just need a system. They need a document. A Legionella risk assessment, for example, can produce a finished report running to around eighty pages, covering every outlet, reading, photograph and recommendation, formatted precisely enough to stand up to scrutiny from a client, an auditor or a regulator. Producing that by hand, assembling photos, readings and narrative into a polished PDF, is slow, repetitive and exactly the kind of work software should do instead of a person.
Studio44 InsightsEstate planning is a business built on trust, paperwork and timing. Each client has a story, a set of documents and a series of deadlines. A single case can involve first calls, fact finding meetings, drafted documents, signing appointments, safe storage and later reviews. When all of that is spread across inboxes, spreadsheets, phone notes and shared drives, things get missed, and in a sector where accuracy matters, that is a real risk.
Studio44 Insights