If you saw headlines this week about a big PHP security problem, you may have wondered whether your website was at risk. We wanted to explain what happened in plain English and let you know that we have things handled.
What happened
PHP is the programming language behind a large share of the web, including WordPress and most of the sites we build and host. On October 21, the PHP project released updates fixing two critical flaws, known as CVE-2026-109618 and CVE-2026-109619.
In simple terms, both flaws were in the parts of PHP that handle memory and errors, which nearly every page visit uses. Under the right conditions, an attacker could send a specially crafted request to a server and run their own code on it, without logging in. Each flaw was rated 9.2 out of 10 for severity. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions, PHP 8.1 and earlier, won’t get a fix at all, so the only safe option for them is moving to a supported version.
The release also came a day earlier than planned. Details started circulating online before the official date, so the PHP team moved it up to get fixes into everyone’s hands faster.
Why there seem to be more of these lately
You’re not imagining it. Google’s threat research team reports that the number of software flaws disclosed each month roughly doubled during 2026. Bloomberg reported that the national vulnerability database was on pace to double last year’s record.
A big reason is that finding bugs has gotten faster. Security firms and researchers now use AI-assisted tools to comb through software, including older code that has been around for years. These PHP flaws were found that way: the PHP Foundation credits a professional security audit and several research teams, some using AI tools. The Foundation also says its security team is getting far more reports than ever, and expects that to keep growing.
There’s good news in that. Most of these flaws are being found by the good guys first and fixed before they can do harm. Attackers are moving faster too, though, so how quickly updates get applied matters more than ever.
What we did
We were ready for this one. All of the client websites we host had already been moved to current, supported versions of PHP. Most run PHP 8.4, and a few run PHP 8.2. Both of those versions received the fix, so none of our hosted sites were stuck on an outdated version with no patch available.
Our managed hosting partner, KnownHost, worked around the clock to roll out the fixes across their entire network automatically. They report that their shared, reseller, WordPress, PCI-compliant and semi-dedicated servers are all fully patched, and that patching for managed cPanel and CloudLinux servers is complete or underway. Our server is covered by that network-wide rollout.
Our server also runs Imunify security protection, which adds an extra layer of monitoring and defense against malicious traffic and malware.
Do you need to do anything?
Nope. There’s nothing you need to change, update or install. We’ll keep an eye on things like we always do.
If you have any questions, or just want to talk through how your site is protected, reach out to me anytime. That’s what we’re here for.
Thanks for trusting us with your website.
David Turner
David Turner Designs
