You should not need to follow software security announcements to run a business. But when a serious issue affects the technology behind your website, somebody needs to be paying attention.
On 21 October 2026, the PHP project released emergency updates for two critical security vulnerabilities. For business owners, the useful question is simple: has the software running your website been checked and patched?
What happened?
PHP is the software that runs WordPress and many other websites on their hosting servers. The official PHP security advisory describes two flaws, CVE-2026-109618 and CVE-2026-109619, that could allow attackers to run code without logging in.
The PHP team recommends an immediate update. The fixes were released in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some hosting platforms receive equivalent fixes through their operating system supplier, so the provider needs to confirm the patch status rather than relying on the version number alone.
That does not mean every affected website has been hacked. It does mean this deserves prompt attention from whoever manages the server.
Why updating WordPress is not enough
Your website has several layers. WordPress, its theme and its plugins sit on top of server software, including PHP. Clicking “update” in your WordPress dashboard normally updates the application layer. It does not install PHP security patches on your hosting server.
A website can therefore have current plugins and still need an urgent hosting update. It can also look perfectly normal while that work remains outstanding.
This is why it helps to know who owns each responsibility. Does your hosting company manage PHP updates? Who checks the website afterwards? If your developer and host are different businesses, who coordinates the response?
Three questions to ask your provider
If you run a WordPress website, contact your hosting provider or website support company and ask:
- Have the 21 October PHP security fixes been applied to the environment serving my website? Ask for confirmation for your site, including any vendor-supplied equivalent patch.
- Has the website been checked after the update? Important pages, forms, logins and checkout journeys should still work.
- Who handles urgent security updates between scheduled maintenance visits? A critical alert needs its own response, even if your next routine review is weeks away.
If nobody can give you a clear answer, that is a good reason to review your support arrangements.
The value of managed hosting
Much of the value of managed hosting is work you never see: tracking security notices, applying relevant updates and checking the result. Backups and monitoring support that work, but they do not replace patching.
For a small business, having a clear point of contact can be just as valuable as the technical work. You want to know who is handling the problem, what has been done and whether anything needs your attention.
At Red Web, our managed website hosting covers the underlying hosting infrastructure, with WordPress maintenance available for ongoing website care. We can help you work out what your current arrangements cover and where there are gaps.
Unsure who is looking after your website behind the scenes? Talk to us about your hosting and maintenance.