You may have seen the headlines this week about a critical PHP security vulnerability. PHP powers a huge share of the web, including every WordPress website, so it’s no surprise that plenty of business owners have been asking whether their site is at risk.
The short answer for our hosting customers is that your website is protected. Here’s what happened, what we’ve done about it and what it means for you.
What is the PHP security vulnerability?
PHP is the programming language that runs behind the scenes on most websites. It builds your pages, talks to your database and handles things like contact forms and online shops before anything reaches a visitor’s browser.
On 21 October 2026, the PHP project released urgent updates to fix two critical vulnerabilities, known as CVE-2026-109618 and CVE-2026-109619. In the right conditions, these flaws could allow an attacker to run their own code on a web server without needing to log in. The National Cyber Security Centre issued an alert the same day, encouraging UK organisations to update immediately.
In plain English, one flaw relates to how PHP behaves when it runs out of memory, and the other relates to leftover data from one visitor’s request being picked up by the next. Either could give an attacker a way in, which is why the response from the hosting world has been so swift.
What we’ve done to protect your website
As soon as we learned of the issue on the morning of 21 October, our team got to work:
- Extra protection straight away. Before any official fix was available, we strengthened the security on our servers to reduce the risk of the vulnerability being exploited.
- Mitigations across our infrastructure. Working alongside our upstream infrastructure provider, protective measures were rolled out across our entire hosting platform.
- Patched as soon as fixes landed. Overnight, in line with guidance from PHP and the NCSC, we monitored, updated and patched every service across our hosting infrastructure as soon as the fixed versions were released.
- Dedicated servers for every customer. All of our customers’ websites run on dedicated virtual private servers (VPS), each with their own cPanel instance, which keeps each website separate and secure, and every one is now protected against this exploit.
Do you need to do anything?
If we host your website, you’re all set. We’ve taken care of everything on your behalf, and your website will carry on running as normal.
If you have any questions at all, our team is always happy to talk them through with you.
If your website is hosted elsewhere
If your website sits with another hosting provider, now is a great time to check in with them. The key things to confirm are:
- Your server is running one of the patched PHP versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35
- If your website still runs on PHP 8.1 or older, there’s a plan to move it onto a supported version, as these older versions no longer receive regular security updates from the PHP project
- Your host is following the latest NCSC guidance on the PHP security issue
If you’d rather have experts looking after this for you, our managed website hosting keeps your website updated, monitored and secure, so you can focus on running your business.
Staying vigilant
Website security is an ongoing commitment rather than a one-off task. We keep a close eye on security advisories from PHP, the NCSC and our infrastructure partners, and we act quickly whenever something new emerges.
Rest assured, we’re on the case, today and for whatever comes next. If you’d like to chat about the security of your website, get in touch with our team.
