This month two critical flaws were found in PHP, the language WordPress runs on. Every site we host was protected at server level before the fixes were published, and our clients didn’t need to do a thing.
If your website is hosted somewhere else, here’s how flaws like this get fixed and what to check.
What Happened This Month
On the 21st of October, the PHP team released fixes for two critical security flaws, numbered CVE-2026-109618 and CVE-2026-109619. Both scored 9.2 out of 10. They let someone with no login run their own code on a web server.
PHP is the language WordPress is written in. According to W3Techs it runs on 69.3% of websites whose server language is known, so a flaw in PHP itself reaches far more sites than a flaw in one plugin.
The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP’s own advice was that updating is the only complete fix.
Why Websites Get Hacked
Attacks on small business websites are rarely personal. Automated tools scan the web all day looking for the same handful of weak spots:
- Out-of-date plugins, themes or WordPress itself
- Plugins that are still installed but no longer used or updated by their makers
- An old version of PHP on the server
- Weak or shared logins with no two-step sign-in
- No recent backup, so a problem can’t be rolled back
How Security Flaws Get Fixed
A flaw is usually found by a security researcher and reported privately to the people who make the software. They write a fix, then announce the flaw and release the fix together.
The risky part is the gap after that. Once a flaw is public, attackers start scanning for sites that haven’t been updated, and a website stays exposed until someone applies the fix. Who that is depends on the layer:
- The server and PHP are your host’s job
- WordPress, the theme and plugins are the job of whoever looks after your website
- Logins and passwords are yours and anyone you’ve given access to
Some hosts apply server fixes for you. Others send an email asking you to change the PHP version yourself, put it behind a support ticket or leave old versions running.
Six Checks You Can Make Today
If you look after your own website, or you’re not sure who does, start here.
- Update WordPress, your theme and every plugin. Then delete any plugin you don’t use.
- Check your PHP version in your hosting control panel and ensure it’s updated.
- Turn on two-step sign-in for every login on your website, your hosting and your domain.
- Give everyone their own login and remove anyone who’s left.
- Make sure there’s a recent backup kept somewhere other than your server, and that it’s been restored at least once.
- Know who to call if something goes wrong, and how to reach them.
How We Look After Websites We Host
This month showed how professional maintenance is vital. Sites we host had protection in place before the PHP fixes were even out and nobody had to log in or press anything. This is what every hosting client gets:
- Server and PHP fixes applied by our hosting platform. This month, protection was in place on every server before the fixes were published.
- WordPress, theme and plugin updates done by us every week, with a backup taken first.
- Security updates applied as soon as they’re released.
- Every site checked against a database of known vulnerabilities several times a day, with alerts coming straight to us.
- Uptime checked around the clock, with alerts coming to us.
- Daily backups, with copies kept away from the server.
You don’t have to log in, press update or read a security bulletin. If something needs your attention, we’ll tell you. See what our hosting and maintenance includes.
Is Your Host Doing This
If your website is hosted somewhere else, it’s worth checking if it’s definitely protected.
- Critical security fixes are applied to your site as soon as they’re released.
- PHP is kept up to date for you.
- WordPress, your theme and plugins are updated for you, not left to you.
- Backups are kept away from the server and restored now and then to test them.
- Your site is monitored, so your host notices a problem before you do.
Want a second opinion on your website’s security? Get in touch and we’ll take a look.