PHP security update: the facts and how we respond to protect your business

Client update | 23 October 2026

Security headlines can leave business owners wondering whether their website, customer information and business assets are safe.

The recent PHP security announcement deserves attention. However, a vulnerability announcement, an attempted attack and a confirmed compromise are three different things.

At Cartmell Communications, our response is to check the facts, review the environments we manage and address the risk. This work supports our clients across South Africa, Ireland and the wider EU.

What has actually happened?

On 21 October 2026, the PHP Project published details of two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619.

These flaws can allow an attacker to execute code remotely without logging in. PHP identified potential exposure across installations handling website requests, with the highest stated risk affecting Apache configurations using mod_php. These are PHP vulnerabilities, rather than flaws limited to WordPress or a particular plugin.

PHP released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Its guidance is clear: temporary protective measures do not fully resolve the vulnerabilities. Updating is essential.

The risk is serious. But the announcement does not establish that every affected website has been hacked, or that every hosting provider has suffered a breach.

What we did in response

On 22 October, we reviewed the PHP configuration across our xneelo and Hetzner hosting environments, checking the websites and server settings under our management.

Our focus was to establish which PHP versions were in use, compare the hosting providers’ updates with the official guidance and identify anything requiring further attention.

This distinction matters: selecting “PHP 8.4” in a hosting control panel does not, by itself, confirm the installed security patch. Verification requires the full running version or confirmation that the provider has applied an appropriate patched package.

Hetzner reported deploying patches for PHP 7.4 and 8.0 through 8.5 across its Webhosting and Managed Servers on 21 October. It subsequently reported patches for the remaining PHP 5.6 and 7.3 versions on 22 October. Its notice separately addressed dedicated and cloud server customers, so the scope of a provider’s announcement must always be checked against the service being used.

Where a client uses independently managed infrastructure, we work with their server administrator or IT provider to establish what needs updating and who is responsible for doing it.

A patched server and a clean website are separate checks

Installing a security update closes the vulnerabilities it addresses. It does not automatically remove malicious files or unauthorised access introduced before the update.

That is why patching and investigation serve different purposes.

Where suspicious activity is identified, a website review may include:

• Administrator accounts and access permissions.

• Unfamiliar plugins, extensions or themes.

• Unexpected files, particularly executable files in upload folders.

• Changes to configuration files.

• Scheduled tasks that could maintain unauthorised access.

• Available logs and backups to help establish what happened.

An unfamiliar file is a reason to investigate. It is not, on its own, proof that these particular PHP vulnerabilities were exploited.

Equally, a website that looks normal should not automatically be assumed clean.

Security has been an ongoing subject for us

Our advice on website security predates this announcement.

On 25 July 2026, we published our article discussing WP2Shell and ongoing website maintenance. It addressed update management, expired licences, unsupported components and the need for someone to take responsibility for a website after launch.

Our blog has also covered backup limitations, website security responsibilities and the risks facing smaller businesses. Those articles appeared before the October PHP announcement.

The latest advisory reinforces the need for that ongoing work. Security requires attention between major announcements as well as during them.

How we approach protection throughout the year

Our approach combines hosting oversight with website maintenance, according to the services we manage for each client.

That includes keeping supported software current, managing website updates and licences, configuring appropriate security controls, maintaining backups and investigating warning signs.

Different controls serve different purposes:

• Server updates address weaknesses in the hosting software.

• Website updates address weaknesses in the CMS, plugins, extensions and themes.

• Access controls reduce opportunities for unauthorised administration.

• Firewalls help filter unwanted requests.

• Monitoring and investigation help identify problems requiring action.

• Backups and recovery planning support restoration when something goes wrong.

A firewall cannot replace a required PHP patch. A backup cannot prevent an attack. A security plugin cannot take responsibility for the whole server.

Effective protection depends on these measures working together, with clear responsibility for maintaining them.

Protecting your business assets

Your website can contain original content, designs, product information, custom development and valuable business integrations. It may also process customer information and enquiries.

Protecting these assets involves more than keeping the homepage online. It requires attention to access, software, configuration and recovery.

No responsible provider can promise that a website will never be compromised. Our role is to reduce risk, respond to credible warnings and explain what has been checked, what has been confirmed and what still needs attention.

What should you do now?

If we manage your hosting or website, contact us if you would like clarification on the scope of your service or the checks relevant to your website.

If another provider manages your server, ask them to confirm that the PHP installation serving your website includes the fixes for both vulnerabilities. A general answer such as “you are running PHP 8” is insufficient.

Report unexpected administrator accounts, redirects, changed content or security warnings promptly.

For clients in South Africa, Ireland and across the EU, our approach remains consistent: verify the information, address the exposure and keep looking after the website once the headlines have moved on.

Unsure who is responsible for your website’s updates, security and recovery? Contact Cartmell Communications so we can help you establish what is covered and what needs attention.