Umbraco is .NET, not PHP

Written by Mats Persson

This week, CERT-EU warned that organisations unable to patch two critical PHP vulnerabilities quickly should consider taking internet-facing sites offline. Both flaws are rated 9.2 out of 10 and could allow remote code execution without logging in. That is serious news for large parts of the web.

Since the story broke, lots of you have reached out with the same question: does this affect my Umbraco site? The short answer is no - Umbraco doesn’t run on PHP, so we weren’t hit by this one. This time. But first, a word to everyone in the PHP community patching servers this week: we feel for you.

Built on Microsoft .NET from day one

Umbraco has been a .NET CMS since it was founded in Denmark more than 20 years ago. Today it runs on modern ASP.NET Core and the latest versions of .NET, an open-source platform that Microsoft maintains and patches on a regular, published schedule.

That choice was never about PHP being bad. It was about giving developers a strongly typed, high-performance foundation, and giving organisations a stack their IT and security teams already know and trust. We’re proud of that foundation. But this isn’t the time to gloat or sell. Vulnerabilities can hit any technology, and the web is stronger when we look out for each other.

What this means for you

Umbraco CMS and Umbraco Cloud do not use the PHP runtime, so these two vulnerabilities do not affect Umbraco itself.

Check the rest of your estate. If your organisation also runs PHP-based sites, plugins or tools alongside Umbraco, follow CERT-EU’s guidance and patch them as soon as possible.

Our partners can reassure clients with confidence, and we’re happy to help answer questions.

Security is never “someone else’s problem”

No stack is safe for long. With AI giving both good and bad actors superpowers, next time it could be .NET, Rust, or Go. As painful as a week like this is, it’s also how the web gets safer: issues that were unknown get published and fixed, for everyone. At Umbraco, we work with our community through responsible disclosure, publish security advisories openly, and ship patches promptly. And we’re taking this week as our own reminder to check that our processes are ready for when it’s our stack’s turn. For you, keeping your Umbraco and .NET versions up to date remains the single best thing you can do.

That openness is one of the real strengths of open source: the whole world can help find and fix issues, and that’s exactly what we’re seeing. The number of security issues reported to us is going up, and you can see it in the number of releases we ship. More reported issues don’t mean less secure software. It means more eyes on the code, and more issues found and fixed before they can be used against you.

Our CPTO, Filip, summed it up on LinkedIn this week: “We are all PHP.” The warm response to his post says a lot about the kind of community we want to be. If you haven’t read it yet, take a look at Filip’s post. It captures the friendly Umbraco spirit better than any statement could.

Got questions? Our team is always happy to help here. And to all the sysadmins, ops, and SRE people who’ve been working overtime this week: thank you for your efforts.

#H5YR