You may have seen reports in the news about a serious security issue affecting PHP, the technology that sits behind a huge proportion of websites worldwide, roughly 70% in fact.
First of all: don’t panic, but do make sure your hosting provider has acted.
What has happened?
Two critical security vulnerabilities have been discovered in PHP. In simple terms, these vulnerabilities could potentially allow an attacker to run malicious code on a vulnerable web server without needing to log in first.
Because PHP is used by a huge number of websites, including sites running WordPress, Drupal, Joomla and many other platforms, the issue has attracted significant attention. Some organisations have even temporarily taken websites offline while their servers are being secured.
Security patches have now been released and need to be applied urgently.
Is this a problem with my website?
Importantly, this isn’t an issue that can normally be fixed by developers, or simply updating your WordPress website, plugins or theme.
PHP runs on the web server, which means responsibility for applying these critical PHP security patches sits with whoever manages your website hosting.
If your website is hosted with us
You’re covered.
The hosting infrastructure we use has had the required PHP security updates applied, so you don’t need to make any changes to your website or contact us to request the update.
Our hosting provider has been actively deploying the security fixes across its server infrastructure following the release of the patches. See the status here.
If your website is hosted elsewhere
Please contact your hosting provider now.
Ask them specifically whether their servers have been patched against the critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619.
This isn’t something we’d recommend leaving until a routine maintenance window. The vulnerabilities are considered critical, and the official guidance is for affected PHP installations to be updated immediately.
If your host hasn’t yet applied the security fixes, ask them when they will be doing so and what measures they have in place to protect your website in the meantime.
The important bit
If we manage your hosting, we’ve got the server-side updates covered.
If your website is hosted by somebody else, please check with your own hosting company today. Don’t assume that updating WordPress itself will resolve the issue. The necessary security work needs to happen at hosting/server level.
As always, we’ll continue to keep an eye on developments and take any necessary action for the websites and hosting we manage.