Your website looks normal. The contact form works, and customers can still browse your services. Then you hear about a critical PHP vulnerability.
Does your website need an update? Has your hosting provider already handled it? And who should you contact?
The first step is to establish who manages the software running your website and ask them to confirm whether the fixes apply. A working website does not tell you whether its underlying software has been patched.
What Has Happened?
On 21 October 2026, PHP released emergency security updates addressing CVE-2026-109618 and CVE-2026-109619. These vulnerabilities can allow an attacker to execute malicious code on affected servers without logging in. The PHP project urges affected users to update immediately. 2026
PHP is software used behind the scenes to run many websites and applications. PHP-FPM is one way a server processes PHP requests.
The two CVE numbers identify separate security flaws in how PHP handles memory and information associated with web requests. They are reference numbers for vulnerabilities.
Not two files that website owners can simply locate and delete.
For business owners, the practical issue is whether their website uses an affected PHP installation and whether the responsible provider has applied the fix.
“My Website Is Working. Do I Still Need to Check?”
Yes, if your website runs on PHP and its patch status is unknown.
A vulnerability can exist without changing how your website looks. Equally, a security announcement does not mean your website has been hacked.
At ITechStudio, our recommended approach is to separate three questions:
- Applicability: Does the affected software run this website?
- Remediation: Has the relevant security update been applied?
- Investigation: Is there evidence of unauthorised activity?
Getting clear answers prevents both unnecessary alarm and the assumption that everything is safe because the homepage still loads.
Who Should You Contact?
Your domain, email and website hosting may come from different companies. The provider sending your domain renewal invoice may have no control over the server running your website.
| Your website setup | Where to direct the question |
|---|---|
| WordPress on shared hosting | The web hosting provider |
| Managed WordPress hosting | The managed hosting provider; ask what its maintenance covers |
| Squarespace-hosted website | Squarespace Support |
| A server managed by your developer or agency | The developer, agency or server administrator responsible for updates |
| A self-managed VPS or cloud server | Your server administrator or IT team |
Contact whoever controls the website’s server software. If you are unsure, your website developer can help identify that party.
“Doesn’t My Host Update Everything Automatically?”
Some providers manage server security updates. Others leave more responsibility with the customer or their appointed administrator.
The word managed also needs context. A provider may manage server software while your developer maintains WordPress, themes and plugins.
For this incident, ask for confirmation covering the specific vulnerabilities. A general statement such as “we update our servers regularly” provides less certainty than confirmation that both CVEs have been addressed on the infrastructure serving your website.
Where applicable, the administrator should also confirm that running PHP processes have been restarted or replaced so the patched software is actually in use.
Updating WordPress Is Only Part of the Picture
For a WordPress website, maintenance involves several layers:
| Layer | Typical examples |
|---|---|
| Website software | WordPress, themes and plugins |
| Server software | PHP and the web server |
| Hosting infrastructure | Operating system, containers and related services |
Updating a plugin does not establish that the PHP runtime has been patched.
The PHP project released fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Hosting vendors may also supply backported fixes, so a version number alone may not settle the question. Ask the provider to confirm coverage for the two CVEs. 2026
A Message You Can Send Your Hosting Provider
Hi, we are checking the security status of [website address] following the PHP advisories for CVE-2026-109618 and CVE-2026-109619.
Could you confirm whether our website’s hosting environment is affected? If so, have the relevant fixes been applied and the affected PHP processes restarted or replaced?
Please let us know whether any action is required from us or our website developer.
Keep the reply with your website maintenance records. If it is unclear, ask your developer to review it and identify what remains outstanding.
What Should Be Checked After an Update?
Once the provider confirms the update, check the parts of the website that matter to your business:
- Contact forms submit successfully and enquiries arrive.
- Booking and payment journeys work, where applicable.
- Important pages load without errors.
- Tracking still records the intended actions.
If there are signs of unauthorised changes, unexpected redirects or suspicious accounts, request a security investigation. Applying an update closes the vulnerability; it does not establish whether earlier misuse occurred.
ITechStudio’s Perspective: Make Responsibility Clear
Website maintenance works best when someone can answer three practical questions:
Who manages the server? Who maintains the website software? Who checks that enquiries and bookings still work after changes?
At ITechStudio, we keep up with security advisories, including newly disclosed and zero-day vulnerabilities, to understand which developments require attention for our clients’ websites. When an issue arises, we review the hosting provider’s guidance, identify any action needed and coordinate the appropriate checks.
This proactive approach is one reason we recommend SiteGround for suitable WordPress websites. For the October 2026 PHP vulnerabilities, SiteGround reported that it had applied server-level protective measures before the official security release, with no customer updates or settings changes required at that stage. This was its stated protection response, rather than confirmation that every underlying PHP installation had received the final patches. siteground.com
Hosting protection and website maintenance work together. We review relevant provider notices, arrange any necessary website updates and carry out practical checks afterwards–from page loading to contact forms and booking journeys–to confirm that important functions continue to work.
These responsibilities may sit with different providers. Clear ownership helps businesses respond promptly and understand what has been addressed.
Unsure who manages your website’s hosting or updates? Contact ITechStudio to discuss your setup, maintenance needs and the checks to coordinate with your hosting provider.