PHP Security Alert: Shine Forms Is Not Affected
The UK’s National Cyber Security Centre (NCSC) has warned of a critical security issue affecting PHP, the programming language that runs a large share of the world’s websites, including every WordPress site.
The short version: Shine Forms is not affected. None of our software or online services use PHP. There’s nothing for you to update or change.
What the issue is
Two flaws were found in PHP itself, logged as CVE-2026-109618 and CVE-2026-109619 and nicknamed “php2shell”. On a web server running PHP, they can let an attacker run their own code on the server without logging in.
The PHP project released fixed versions on 21 October 2026 (8.5.12, 8.4.27, 8.3.36 and 8.2.35). The NCSC is urging organisations that run PHP to update straight away.
What we checked
We didn’t want to answer this from memory, so we audited every part of Shine Forms that we build and run:
- Shine Forms Desktop (formerly Pirform), its companion tools and the Shine Forms tablet app for iPad and Android. All are built on Microsoft .NET and run on your own PC or tablet. None of them contain PHP.
- Shine Forms Online, your Shine Forms account and the store, plus the licence service the desktop software talks to. These are built on .NET and run in Microsoft Azure on Microsoft’s own .NET server images, which don’t include PHP.
- This website. The pages are built in advance and served as plain files from Microsoft Azure. The few interactive parts, like newsletter sign-up, run on .NET.
- How we build and release. None of our build and release pipelines use PHP.
We searched every source file, software package, server image, build pipeline and hosting setting across our code, including the exact versions that are live today. We found no PHP code, no PHP packages and no PHP running anywhere.
Like most software companies, we also use a few specialist providers, for things like card payments and email. They run their own services and are responsible for keeping them patched.
We completed this review on 22 October 2026.
Do I need to do anything?
Not for Shine Forms. You don’t need to install an update or change any settings. Keep using Shine Forms as normal.
If you have your own website
Plenty of contractors have a company website built on WordPress, which runs on PHP. If that’s you, send a quick message to your web host or developer and ask them to confirm PHP has been updated to one of the fixed versions above.
The NCSC’s alert has the full detail.
Questions?
If you have any questions about this, contact us at support@shineforms.co.uk.