Mostly PHP, and Mostly Unaffected
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Stelae, a static WordPress host, was largely shielded from the php2shell PHP runtime flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) because its public sites are plain static files and its WordPress editors sit behind a Go proxy that only forwards requests carrying a secret editor link.