PHP2Shell and Your StartHere.care Information
On October 21, two serious flaws in PHP were made public along with fixes, and security researchers have named them PHP2Shell. PHP is the programming language behind a large share of the world's websites, including most WordPress sites, and these flaws can let an attacker take over an unpatched web server without logging in. Amazon's threat intelligence team recorded an attempt to use them on October 17, four days before the fixes came out.1 Because news like this makes people wonder about every site that holds their information, we want every client and therapist on StartHere.care to hear directly from us.
Your information is not exposed to PHP2Shell
StartHere.care does not run on PHP. The website and the database that holds your account are built on services that do not use it, so these flaws have no path to your information.
An unused hosting account can no longer send email as us
While we checked, we found an old web hosting account tied to our domain that we no longer use. It never held any of your information, but our email settings still allowed it to send messages under the StartHere.care name, so a break-in there could have been used to send fake email that looked like it came from us. On October 22 we removed those settings, and that account can no longer send email that passes as StartHere.care.
What you need to do
You do not need to do anything. We will never ask for your password by email or text message. If a message that claims to be from us ever looks wrong, forward it to info@starthere.care and I will look into it myself.
Sources
- Help Net Security on the PHP2Shell fixes and the first exploitation attempt, October 21, 2026.