Website Design for Australian Small Business (2026)
What a small business website costs in Australia in 2026, with real published prices, plus .com.au rules, GST, hosting, privacy and a hiring checklist.
Website Security
Wix, Squarespace, Shopify and the PHP Flaw: Do You Need to Act?
If your site runs on a hosted builder, the October 2026 PHP flaws are mostly the platform's problem to fix, not yours. This guide shows what each platform had published when we checked on 22 October 2026, what to ask support, and the parts that still sit with you, such as apps and any PHP hosted somewhere else.
Key takeaways
- On a hosted builder, you do not update PHP. Wix, Squarespace, Shopify, Webflow and Framer run the servers. If a fix is needed on their side, their engineers apply it, not you. Our main guide to the PHP vulnerability and what website owners should do explains the flaws in full.
- Only Webflow had a notice about it. Webflow's Trust Center said on 21 October 2026 that no customer action is required. For Wix, Squarespace, Shopify and Framer we found no statement about these flaws on their security pages or, where we could read them, their status pages (checked 22 October 2026).
- Squarespace's status page does mention PHP2SHELL, but for Acuity Scheduling. It lists an emergency maintenance on 21 October 2026 for that product, not for Squarespace websites.
- Your own part is smaller but real. Check any PHP you host elsewhere, any WordPress blog on a subdomain, and any connected tool that runs on a PHP server.
- Send one short question to support. You will find the wording below. Keep the reply, so you have it in writing.
Why a hosted builder is different
The two flaws, CVE-2026-109618 and CVE-2026-109619, sit in PHP, the software that runs many websites on a server. The php.net advisory of 21 October 2026 says they affect PHP installations that serve web requests, and the fix is a newer PHP release on the server.
On WordPress, you or your host own that server. On Wix, Squarespace, Shopify, Webflow or Framer, the company owns it. You never log in to it, never choose its PHP version, and cannot update it. That is part of what you pay for.
There is nothing for you to click. Anyone who tells you to "update PHP on your Squarespace site" is guessing. You also cannot see inside, and none of the pages we read said whether PHP is used anywhere in the platform's stack. So ask, and treat a written answer as the proof.
What we found on 22 October 2026
We read each company's own security page and, where we could, its status page. We did not use forums, social posts or press guesses about what a platform runs. Each table says what the page said and what to do.
Webflow
| What we found on 22 October 2026 | What to do |
|---|---|
| Webflow's Trust Center, in a notice of 21 October 2026, says no customer action is required | Nothing to update. Keep a link to the notice if a client asks |
| The notice speaks for Webflow's own services, not for tools you connect | Check any outside app, embed or form tool you added |
Our guide on whether Webflow is secure and runs PHP goes through the notice in more detail.
Wix
| What we found on 22 October 2026 | What to do |
|---|---|
| Wix's security page (wix.com/security) says sites get fully managed protection with round the clock monitoring, and that Wix runs automated vulnerability scans. It does not mention PHP or these flaws | Do nothing to the site itself. Ask support the question below if you want it in writing |
| Wix's status page (status.wix.com) showed all systems operational and no incidents from 8 to 22 October 2026. It also says some issues may not appear there | Do not read "no incident" as a statement about PHP. It is only a status board |
Squarespace
| What we found on 22 October 2026 | What to do |
|---|---|
| Squarespace's status page (status.squarespace.com) lists no incident for Squarespace websites in October 2026, apart from the item below | Nothing to update on a normal Squarespace site |
| The same page lists an emergency maintenance on 21 October 2026 for Acuity Scheduling, completed at 14:42 Eastern time. It names PHP2SHELL, calls it a critical flaw rated 9.2 out of 10, and says it affects popular web software, including tools Acuity relies on | If you use Acuity for bookings, read any email from Acuity and check your bookings still work. This is where the search "php2shell squarespace" leads |
| We found no Squarespace statement about website hosting and these flaws | Ask support the question below and keep the answer |
That entry shows one product was taken offline to deal with the flaw. It does not tell us what Squarespace's website hosting runs, and we will not guess.
Shopify
| What we found on 22 October 2026 | What to do |
|---|---|
| Shopify's security page covers its PCI DSS Level 1 certification, its SOC reports and privacy. It does not mention PHP or these flaws | Nothing to update in the store itself |
| Shopify's status page showed all systems operational and no incidents from 8 to 22 October 2026. It adds that some issues affecting few stores may not be listed | Treat it as a status board, not a security notice |
| Your store may use apps from outside developers | Open your app list and check who runs each one. See the apps section below |
Framer
| What we found on 22 October 2026 | What to do |
|---|---|
| Framer's security page says Framer manages its own infrastructure, which runs on Amazon Web Services. It does not mention PHP or these flaws | Nothing to update on your Framer site |
| We did not read a Framer status page | Ask support if you want a written answer |
What to ask support
You do not need technical words. A short message is enough, and it gets you a reply you can keep. Something like this works on any of the five platforms:
Hello. A critical PHP flaw (CVE-2026-109618 and CVE-2026-109619) was announced on 21 October 2026. Does it affect the servers that host my site, and is any action needed from me? Please reply in writing.
Then follow this order.
- Use the platform's official help channel, from the account owner's login. Do not answer anyone who contacts you first about this.
- Save the reply as a screenshot or email, in case a client or insurer asks.
- Never share a password in the chat.
- Ignore emails that tell you to "patch your account" through a link. Scam emails ride on news like this.
If your host is not a builder at all, use the list in what to ask your web host about the PHP security fix instead.
What is still your job
A hosted builder takes the server off your plate. It does not take everything off it. Here is what still sits with you.
| Part of your setup | Why it may matter | What to do |
|---|---|---|
| A WordPress blog on a subdomain, such as blog.yourname.com | It is a separate PHP site on a separate host | Treat it as a WordPress site. See how to check and update your PHP version |
| Old PHP pages or a PHP contact form on cheap hosting that you linked to | They run on your own host, not the platform | Ask that host about the fixed version |
| A WooCommerce or other PHP shop connected to your builder site | It is a PHP site | Read our WooCommerce guide to the PHP flaw |
| Apps, widgets and booking tools from outside developers | Some run on their own servers, and you cannot see which | Open each tool's own status or security page and send the same question |
That list is the real answer to "do I need to act". For most small business owners on a builder, the answer is one short message to support and a tidy-up of the extras above.
What is still unclear
- What each platform runs. None of the pages we read says whether PHP is used anywhere in its stack. That is a gap in what they published, not proof either way.
- Whether silence means safe. A company may have checked and found nothing to say, or may not have published yet. We cannot tell which from outside. Webflow's notice is the one clear statement we found.
- Pages we could not read. We read the security pages of Wix, Shopify and Framer, and the status pages of Wix, Shopify and Squarespace. We did not read help centre articles or a Framer status page, so a notice may exist there. Check these yourself if the answer matters to you.
- Third party tools. A platform's statement, if it comes, will not cover every app you installed.
- When this advice does not apply. If any part of your site runs on PHP that you or a host control, the rule from our main PHP guide applies to that part. Old branches also get no official fix, which our PHP end of life guide covers.
Should this change which platform you pick?
Not on its own. A hosted builder moves the update work to someone else, and WordPress can be just as safe when the host patches fast, as our look at managed and shared hosting shows. Our comparison of Squarespace, Webflow and Framer covers the other differences, and our maintenance cost guide shows who owns which update.
How we help at Amariq
Most of what this page covers is somebody else's server, so the useful help is a straight answer on whether you have any PHP at all. If your marketing site sits on a hosted builder but a blog, shop or booking tool runs on WordPress elsewhere, that part is yours to patch. Our team had upgraded WordPress sites to a fixed PHP version before the first full day after the advisory was over, so we know what the work involves. Send us the list of places your site lives and we will tell you which ones need action. Our Webflow maintenance page covers the hosted side. The WordPress PHP update gig on Fiverr covers the WordPress side, and the Fiverr and Upwork reviews and our YouTube channel are open for you to read and watch before you decide.
Frequently asked questions
Does the PHP2Shell flaw affect Squarespace?
We found no statement from Squarespace about its website hosting. Its status page does list an emergency maintenance on 21 October 2026 for Acuity Scheduling that names PHP2SHELL. Ask Squarespace support in writing if you want a clear answer for your site.
Is Wix affected by the PHP vulnerability?
Wix's security page does not mention PHP or these flaws, and its status page showed no incidents from 8 to 22 October 2026. That is not a statement either way. Wix runs the servers, so there is no update for you to make.
Is Shopify affected by the PHP flaw?
We found nothing about it on Shopify's security page or status page on 22 October 2026. Shopify manages the platform, so you cannot update its servers. Check any third party apps in your store, because they run on their own servers.
Is Webflow affected by the PHP issue?
Webflow's Trust Center said on 21 October 2026 that no customer action is required. That covers Webflow's own services. Check any outside tool you embedded in your pages.
Do I need to update PHP on Wix, Squarespace or Shopify?
No. You cannot, because the platform controls the servers and the PHP version if any is used. Your actions are to ask support for a written answer and to check anything you host elsewhere.
What should I do if support does not reply?
Keep the message you sent and try again after a few days through the official help route. If a client or insurer needs an answer, say that you asked and when.
Could my builder site still be hacked because of this?
We have no evidence of that, and none of the pages we read reported it. Weak passwords and outdated connected tools are the more common risks, so turn on two step login.
Should I move off my builder to avoid PHP problems?
No, this news alone is not a reason. If you run WordPress, the fix is a PHP update on your server, and our main PHP guide lists the steps in order.
Elementor PHP Version: What to Check Before You Update
Which PHP version Elementor needs, what it recommends, and how to update PHP without breaking the editor: add-ons, custom CSS, staging and rollback.
Check WordPress Plugins Work With PHP 8.3 Before You Switch
A step by step check for non-developers: read the Requires PHP and Tested up to fields, use Site Health, handle abandoned and premium plugins, and decide.