Security Update: Why Tada Sites Are 100% Immune to the Current PHP Vulnerability

You may have seen news alerts or received security warnings today regarding critical, widespread vulnerabilities discovered in PHP (referred to as PHP2Shell / CVE-2026-109618 & CVE-2026-109619). This issue is causing emergency shutdowns and emergency patching across thousands of traditional websites, especially those running on WordPress, Drupal, or standard shared hosting.

If your website is hosted with Tada, your site is completely safe, unaffected, and requires zero action.

Here is why Tada sites are not vulnerable:

• Zero PHP in Our Stack: The vulnerability exists entirely within the PHP runtime engine. Tada sites are built on modern, enterprise-grade cloud architecture that does not use or execute PHP.
• Static, Serverless Cloud Delivery: Unlike legacy platforms that dynamically generate pages from server-side scripts on every visit, Tada sites are served as pre-rendered, optimized static assets over global Content Delivery Networks (CDNs) hosted on AWS. There is no vulnerable backend web worker or script interpreter for an attacker to hijack.
• No Risky Plugins or Unmanaged Servers: The vast majority of website breaches exploit self-hosted LAMP servers, unpatched runtime libraries, or vulnerable third-party plugins. Our closed, managed SaaS infrastructure eliminates traditional server-side exploit surfaces entirely.

While other business owners are currently scrambling to update server packages, coordinate emergency patches, or deal with downtime, your website remains secure, fast, and fully operational.

If you have any questions about your site's security or hosting environment, please reach out to our support team at support@tadacms.com