.png?width=319&height=267&name=gtmetrix_2023%20(1).png)
The short answer
No. PHP2Shell does not affect websites built with Ocean Pro on HubSpot.
Ocean Pro contains no PHP code, and HubSpot runs the servers your site lives on. There is no PHP installation on your side to exploit or to patch. You do not need to change anything in your theme, your pages or your HubSpot account.
We know a short "no" is not always enough when the headlines say "70% of the Internet", so below we explain what the vulnerability is, what we checked and where you might still want to look.
What PHP2Shell is
PHP2Shell is the nickname for two critical flaws in PHP itself, CVE-2026-109618 and CVE-2026-109619. PHP released the fixes on October 21, 2026, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (PHP advisory via CERT-EU).
In plain terms: an attacker can send a crafted web request to a server running PHP and run their own code on it, without logging in. Both flaws score 9.2 out of 10 in severity, and the U.S. agency CISA asked organizations to patch immediately (CISA).
The concern is real for the platforms built on PHP. Researchers demonstrated attacks on WordPress, Drupal and Joomla (Wiz Research), and online stores on Magento, Shopware and WooCommerce are exposed even when their own code is clean (Sansec). Exploitation in the wild has already been reported (watchTowr).
The key point for you: the flaw lives in the PHP engine. If PHP is not running behind your website, there is nothing for this attack to reach.
What we checked
We reviewed the theme, the platform it runs on and our own live site. Every check points to the same conclusion: there is no PHP in the path between a visitor and an Ocean Pro page.
|
What we checked |
What we found |
|---|---|
|
The Ocean Pro theme files |
Templates and modules written in HubL (HubSpot's template language), HTML, CSS and JavaScript. Zero PHP files. |
|
Where the site runs |
On HubSpot Content Hub, a fully managed platform. Customers never install, configure or update a web server or a PHP runtime. |
|
Custom server-side code on HubSpot |
HubSpot serverless functions run on the Node.js runtime, not PHP (HubSpot developer docs). |
|
Plugins or add-ons Ocean Pro needs |
None. The theme does not depend on any PHP plugin, extension or external PHP connector. |
|
Our own site, ocean-theme.com (scanned October 23, 2026) |
Served by HubSpot as pre-rendered pages from its edge cache, with HubSpot headers and no sign of a PHP stack. |
This is the structural difference with WordPress. On WordPress, PHP runs on every request and the site owner or the host is responsible for updating it. On HubSpot, the infrastructure and its security updates are HubSpot's responsibility, not yours.
Where you should still look
Your Ocean Pro site is safe. Your company's wider web footprint may not be, and this is the honest part of the answer. If any of these run outside HubSpot, ask whoever manages them to confirm they are on PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35:
- A WordPress blog or microsite on a subdomain, often left over from before the move to HubSpot.
- Campaign landing pages or event sites hosted with another provider.
- An online store on WooCommerce, Magento or a similar PHP platform.
- Middleware or custom integrations that sit between HubSpot and your ERP, billing or other systems, if they were built in PHP.
- Internal tools or portals on shared hosting.
One detail matters if you find an old one: PHP no longer releases official updates for versions 8.1 and older (Codeable). A forgotten site on one of those versions is the real risk, because there may be no simple patch to apply.
Frequently asked questions
Do I need to update Ocean Pro?
No. There is no Ocean Pro update related to PHP2Shell because the theme has no PHP to fix.
Does HubSpot need to do anything for my site?
HubSpot operates and secures its own infrastructure. Your pages are not served by a PHP installation you own, so there is no action on your side.
Are my HubSpot forms, CRM data or contacts exposed through this flaw?
Not through your Ocean Pro site. PHP2Shell needs a server running PHP to attack, and your site does not run on one.
What if a security scanner or IT team flags my site?
Ask them which URL triggered the alert. If it is a domain hosted outside HubSpot, review it with its provider. If it is your Ocean Pro site, send us the report and we will review it with you.
Who can I talk to if I still have doubts?
Write to our support team. We would rather answer the question than have you wonder.
Sources
Bernardo Salazar
Co fundador de Media Source. Apasionado de la tecnología y el marketing, me gusta conocer y hacer uso de herramientas que apoyen a lograr resultados en las campañas de marketing digital creando estrategias sólidas y 100% medibles.
