PHP Security Update: What Business Website Owners Should Check

If your business has a website, it is worth checking that your hosting provider has addressed the critical PHP vulnerabilities disclosed in October 2026. You do not need to understand server administration to take the right action, but you should know who is responsible for keeping your website’s underlying software secure.

PHP is software used by many websites, including WordPress sites. On 21 October, security updates were released to fix two vulnerabilities that could allow an attacker to run code on an affected server without signing in.

For most business owners, the next step is to contact the hosting provider or developer who maintains the website and ask them to confirm that the relevant fixes have been applied.

Updating WordPress is not the same as updating PHP

A website has several layers of software. WordPress, its themes and plug-ins are one part of the picture; PHP runs underneath them on the hosting server.

Keeping WordPress updated remains important, but it does not fix a vulnerability in PHP itself. That update normally needs to be handled through your hosting environment, either by the hosting company or whoever manages the server.

This distinction matters because a website can appear completely normal while still running vulnerable software. A working homepage or a dashboard showing no WordPress updates is not confirmation that the server has been patched.

Where Cloudflare helps

We recommend considering services such as Cloudflare as an additional layer of website protection. Its web application firewall can inspect traffic and block requests that match known attack patterns before they reach your website.

During this incident, Cloudflare deployed protections ahead of public disclosure and continued adjusting its mitigations as attackers changed their requests. This illustrates the benefit of having protection that can respond centrally, rather than relying entirely on each website owner to react immediately.

However, Cloudflare is not a substitute for installing the security fixes. Firewall rules target known attack methods, and their effectiveness depends on the website’s configuration and whether traffic actually passes through the protection.

Simply having a Cloudflare account or using its DNS service is not enough to assume your website is protected. Your provider should confirm that the relevant traffic is proxied through Cloudflare and that the appropriate security protections apply.

What your website provider should confirm

Ask whoever maintains your website to confirm that the server has received the fixes for CVE-2026-109618 and CVE-2026-109619, and that they have reviewed the additional PHP advisory published on 23 October.

The initial fixed PHP releases were 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some hosting systems receive security fixes through vendor-maintained packages without adopting those exact version numbers, so the useful question is whether the fixes have been installed, not simply whether a displayed number matches.

If your site uses an older PHP version, ask whether it is receiving maintained security fixes and whether an upgrade is needed. Any compatibility work should be planned with the developer rather than leaving an unsupported version in place indefinitely.

You can send your provider this message:

“Could you please confirm that our website’s hosting has received the fixes for the October 2026 PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and that you have reviewed the additional advisory from 23 October? Please also confirm whether our website has active firewall protection, whether any further action is required, and that the site has been tested following the changes.”

Make sure somebody owns the maintenance

Incidents like this often reveal a gap between website design, hosting and ongoing maintenance. A developer may have built the site without being responsible for server updates, while a hosting package may leave some maintenance decisions to the customer.

Rather than assuming it is covered, establish who handles server security updates, who maintains WordPress and its extensions, and who checks that important functions still work afterwards. Contact forms, bookings and checkout processes deserve particular attention because a homepage loading successfully does not prove everything is working.

A current, recoverable backup is also important before changes are made, although a backup does not prevent an attack or replace security updates.

Does this require an update on your Mac or iPhone?

This incident concerns PHP running on web servers. It is not a reason to install an unfamiliar browser extension, download a “PHP security fix” onto your Mac or follow instructions from an unexpected warning message.

If you are simply visiting websites, the relevant server updates are the responsibility of those websites’ operators. If you own a business website, your role is to obtain confirmation from the people responsible for its hosting and maintenance.

What we would do

We would confirm that the hosting provider has applied the PHP fixes, reviewed the follow-up advisory and checked the website afterwards. We would also review whether a service such as Cloudflare is appropriately configured to provide an additional layer of protection.

The broader lesson is not that every business owner needs to become a server administrator. It is that website maintenance needs a clear owner, supported software and more than one layer of protection.

If you would like help understanding your website provider’s response or reviewing the protection around your business systems, contact Your Mac Tech.