Short answer: Super and every site hosted on Super are not affected by PHP2Shell. No part of Super runs on PHP, so there is nothing to patch on our side and nothing you need to do for your Super site.
What happened
On 20–21 October 2026 the PHP project released fixes for two critical vulnerabilities in PHP itself, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell. Both are rated 9.2 (CVSS v4.0). Under the right conditions, they let an attacker run code on a server that runs PHP, without logging in. Every PHP version from 5.4 up to 8.5.11 is affected; the fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
PHP powers a large part of the web (WordPress, for example, is built on it), so many of you asked whether your Super site is at risk. It is not.
Why Super is not affected
The vulnerabilities are in the PHP interpreter. A server is only exposed if it runs PHP. Super doesn't: we checked our code, our server images and our infrastructure setup, and there is no PHP interpreter anywhere in the platform.
Here is what Super is built on:
Part of Super | What it runs on | PHP? |
Your published site (the pages your visitors see) | Next.js on Node.js, served from Vercel's edge network | No |
Super dashboard (app.super.so) | Next.js on Node.js, hosted on Vercel | No |
API and background jobs (building pages from Notion, publishing, assets, custom domains) | TypeScript on Node.js (NestJS), in containers on AWS | No |
Page and file storage, delivery | Amazon S3 and CloudFront, Cloudflare for images | No |
Databases and queues | PostgreSQL, Redis, Amazon SQS | No |
Analytics and logs | ClickHouse, Elasticsearch | No |
Your content stays in Notion; Super reads it and turns it into static pages that are served from a CDN. Custom code you add to your site (CSS, HTML and JavaScript) runs in your visitors' browsers, not on a server, so it can't bring PHP into the picture either.
Do you need to do anything?
For your Super site: no. There is no setting to change and no update to install.
It is still worth checking the other places your website or business may use PHP, for example:
- A WordPress site, blog or shop on a subdomain or another domain.
- A shared hosting plan (cPanel, Plesk and similar), even if it only hosts an old site or a contact form.
- Self-hosted tools such as forums, wikis or analytics that are written in PHP.
If you use any of these, update PHP to a fixed version (8.5.12, 8.4.27, 8.3.36 or 8.2.35) or ask your hosting provider whether they already did.
FAQs
Is my custom domain affected?
No. When your domain points to Super, its traffic is served by Super's infrastructure, which doesn't run PHP. Other subdomains you point to a different host are only as safe as that host.
Does the advanced protection layer or password protection change anything here?
No. They protect other things (your Notion IDs and private pages). PHP2Shell does not touch Super at all, whatever settings your site uses.
Where can I read more about the vulnerabilities?
- The PHP Foundation: Today's PHP security release
- Qualys: PHP2Shell, PHP patches two critical RCE vulnerabilities
I have another security question.
Write to our support from the chat in the dashboard or on super.so. We are happy to help.
