Why Telosi sites were not affected by PHP2Shell
On October 21, PHP shipped an emergency release for two critical flaws, both rated 9.2 out of 10, that let an attacker run code on a server without logging in. Codeable, Patchstack and the usual security outlets called it PHP2Shell. If you run WordPress, your site runs on PHP, and updating WordPress did nothing about this one. The fix had to come from your host.
Telosi sites didn't need the fix, and I want to explain why without overselling it.
What a Telosi site is made of
When we publish a site, it's rendered once into finished HTML and served from Cloudflare's edge network. There is no PHP on the path between a visitor and your page. There is no plugin, no theme, no admin login on the public site. Bookings, forms and the customer portal talk to our platform, which runs on Cloudflare Workers, not PHP.
So the question "did PHP2Shell affect your sites?" has a short answer: there was no PHP to affect.
What we did anyway
Security isn't one bug. The same week, Node.js, which parts of our platform do use, shipped its own security release for a decompression bug. We patched the one service that was exposed to it the next morning, retired a monitoring tool that couldn't be patched, and rotated the keys that could have been touched if we were wrong. None of that was on a client's to-do list, because none of it is a client's job.
What this means if you're on WordPress
Your host probably patched PHP within a day or two. Your plugins are a different story, and they're most of the risk. Run your site through our scanner; it reads what your site already shows any visitor. If the PHP version is visible, you're trusting someone to update it. Know who.
What this doesn't mean
A Telosi site isn't magic. We have a platform, and platforms have bugs. The difference is that patching ours is our job, on our schedule, with our monitoring. Yours is to run your business.
Book a free audit if you'd like to know what moving would take.