Your CMS is .NET, not PHP – Are Your Website and Applications Affected?
What the latest critical PHP vulnerabilities mean for your CMS, powered by Umbraco
In October 2026, CERT-EU, the cybersecurity service for the EU institutions, warned that organisations unable to quickly patch two critical PHP vulnerabilities should consider taking their internet-facing sites offline. Both flaws are rated 9.2 out of 10 and could allow an attacker to run code remotely without logging in. That is serious news for large parts of the web, and since the story broke many of our clients have asked us the same question: does this affect my CMS?
The short answer is NO. Your pTools CMS is powered by Umbraco, which runs on Microsoft .NET, not PHP. Your website and applications are not affected by these vulnerabilities, and there is nothing you need to do.
Why is Your pTools CMS Not Affected?
Your pTools CMS is powered by Umbraco, which has been a Microsoft .NET CMS since it was founded more than 20 years ago. Today it runs on modern ASP.NET Core and the latest versions of .NET, an open-source platform that Microsoft maintains and patches on a regular, published schedule. Umbraco does not use the PHP runtime at all, so these two vulnerabilities do not affect the platform your website and applications run on.
Image: How your pTools CMS is built – .NET all the way down, no PHP
What This Means for You – At a Glance
The table below summarises where you stand and what, if anything, you need to do:
| Area | Status | What you need to do |
|---|---|---|
| pTools CMS (powered by Umbraco) | Not affected – does not use the PHP runtime | No action needed |
| Your website and applications | Not affected – built on the same .NET foundation | No action needed |
| Platform foundation | Microsoft .NET and ASP.NET Core, patched by Microsoft on a published schedule | Keep your CMS and .NET versions up to date |
| Severity of the PHP flaws | Rated 9.2 out of 10, allowing remote code execution without logging in | Treat as urgent wherever PHP is in use |
| Other PHP-based sites, plugins or tools | Potentially affected | Follow CERT-EU’s guidance and patch as soon as possible |
| Future vulnerabilities | Any technology stack can be hit, including .NET | Stay on current, supported versions |
Built on Microsoft .NET from Day One
A strong, modern foundation: Umbraco, the engine behind your pTools CMS, chose .NET to give developers a strongly typed, high-performance platform to build on, which means robust and reliable websites and applications for you.
A stack your IT team already trusts: .NET is well known to IT and security teams in organisations of every size, making it easier to govern, support and secure.
Regular, predictable patching: Microsoft maintains .NET on a published release and patch schedule, so security fixes arrive in a planned, transparent way.
Security is Never Someone Else’s Problem
Choosing .NET was never about PHP being bad, and this is not a time to gloat. No technology stack is safe for long. With AI giving both good and bad actors new capabilities, next time it could be .NET, Rust or Go. As painful as a week like this is, it is also how the web gets safer: unknown issues get published and fixed, for everyone. Here is how Umbraco, the platform behind your pTools CMS, approaches security:
Image: How open-source security keeps your CMS protected
| Umbraco’s approach | What it means for you |
|---|---|
| Responsible disclosure | Umbraco works with its community to report and resolve security issues in a controlled, responsible way. |
| Open security advisories | Advisories are published openly, so you and your IT team always know what has been found and fixed. |
| Prompt patches | Fixes are shipped promptly. More releases reflect more issues being found and fixed, not less secure software. |
| Open-source scrutiny | The whole world can help find and fix issues. More eyes on the code means problems are caught before they can be used against you. |
Staying up to date is your best defence: Keeping your pTools CMS and .NET versions current remains the single best thing you can do to protect your website and applications. This is why we manage updates for our clients as part of their ongoing support, and why we are moving pTools V8 sites onto pTools CMS 8.1, built on the latest Umbraco 17 and Microsoft .NET 10 with long term support.
Check Your Wider Estate – How Common CMS Platforms Compare
Many organisations run more than one CMS across their websites, intranets and campaign sites. The table below shows the technology behind some widely used platforms, so you can quickly see where these PHP vulnerabilities may apply. It is not a judgement on any platform: every technology has its own security history, and all of them depend on timely patching.
| CMS platform | Built on | Exposed to PHP flaws? |
|---|---|---|
| pTools CMS (powered by Umbraco) | Microsoft .NET (C#, ASP.NET Core) | No – does not use PHP |
| Drupal | PHP | Potentially – check your PHP version and patch |
| WordPress | PHP | Potentially – check your PHP version and patch |
| Joomla | PHP | Potentially – check your PHP version and patch |
If a PHP-based site is hosted and managed by a provider, check with them that the latest PHP security updates have been applied.
What You Should Do Next
Your pTools CMS needs no action. However, if your organisation also runs PHP-based websites, plugins or tools alongside it, please follow CERT-EU’s guidance and patch them as soon as possible. If you are unsure whether any of your other systems are affected, or would simply like some reassurance, our team is happy to help.
Image: Your next steps at a glance
Questions in the meantime?
We are always happy to help. Just get in touch with Suraj Pandey at suraj.pandey@ptools.com