Two critical security vulnerabilities affecting PHP, one of the world’s most widely used website technologies, have prompted urgent action from hosting providers and website administrators around the world this week.<\/p>\n
Following advance warnings on Tuesday 20 October 2026, emergency security updates were released on Wednesday 21 October to address the vulnerabilities, which could potentially allow attackers to gain unauthorised control of vulnerable web servers.<\/p>\n
At Enbecom, we responded rapidly to the announcements, applying security updates to our hosting infrastructure and the servers we manage for clients. We also contacted clients to explain the situation, the steps we had taken and whether any further action was required from them.<\/p>\n
PHP is a programming language that powers a significant proportion of the world’s websites. It operates behind the scenes on web servers, handling tasks such as processing forms, communicating with databases, managing user accounts and generating website content.<\/p>\n
Many popular website platforms, including WordPress, Drupal and Joomla, rely on PHP to function.<\/p>\n
Unlike the software that visitors interact with directly in their web browsers, PHP runs on the server where a website is hosted. This means that keeping PHP secure is generally the responsibility of the hosting provider or whoever manages the server.<\/p>\n
As PHP is so widely used, a serious vulnerability within it can potentially affect a huge number of websites, even when the websites themselves have been properly maintained.<\/p>\n
On Tuesday 20 October, the PHP security team issued an advance warning about two critical vulnerabilities, both receiving a severity score of 9.2 out of 10.<\/p>\n
The vulnerabilities, identified as CVE-2026-109618<\/strong> and CVE-2026-109619<\/strong>, could allow an attacker to exploit weaknesses in PHP’s handling of memory and internal processes.<\/p>\n In certain circumstances, these weaknesses could enable an attacker to execute malicious commands on a vulnerable server remotely, without first needing to log in or know a password.<\/p>\n This type of security flaw is known as a remote code execution vulnerability<\/strong>. It is particularly serious because a successful attack could potentially allow criminals to access sensitive information, alter website files, install malicious software or interfere with other services on the affected server.<\/p>\n The precise consequences would depend on the server’s configuration and the permissions available to PHP, but the potential impact is significant.<\/p>\n Importantly, these vulnerabilities are within PHP itself, rather than in a particular website platform or plugin. This means that even a fully updated WordPress website, for example, could be exposed if the PHP software running on its hosting server had not received the necessary security patches.<\/p>\n Security researchers have demonstrated the possibility of exploiting these vulnerabilities, and attempts to exploit them have been reported in the wild.<\/p>\n The UK’s National Cyber Security Centre (NCSC)<\/a> issued an urgent alert encouraging organisations to identify affected systems, apply the available updates and monitor their services for suspicious activity.<\/p>\n The vulnerabilities affect PHP installations handling web requests, including installations that were running supported PHP versions before the emergency updates.<\/p>\n The PHP developers released the following patched versions on 21 October:<\/p>\n Anyone running an earlier release within one of these PHP version families should ensure that the relevant security updates have been applied.<\/p>\n Older PHP versions are also affected. PHP 8.1 and earlier are no longer officially supported by the PHP project, although some operating system and commercial software providers supply their own security fixes for older versions.<\/p>\n It is worth noting that some providers incorporate security patches into their existing software packages without changing the main PHP version number. The important thing is to confirm that the relevant security fixes have actually been installed, rather than relying on a version number alone.<\/p>\n PHP 8.2 is also approaching the end of its official security support, which finishes on 31 December 2026. Website owners still relying on PHP 8.2 should therefore begin planning a move to a newer supported version.<\/p>\n Protecting the security and reliability of our hosting infrastructure is an ongoing priority at Enbecom.<\/p>\n We regularly update the software running on our hosting servers, including PHP, web server software and other important components.<\/strong> On our standard hosting plans, we only offer PHP versions that remain officially supported, and we install security updates regularly as part of our routine server maintenance.<\/p>\n This approach is particularly important when critical security vulnerabilities are discovered, as it allows us to respond quickly without first having to address the complications associated with obsolete or unsupported software.<\/p>\n When news of the PHP vulnerabilities emerged, we immediately began preparing for the security updates.<\/p>\n Some software providers made their patches available slightly ahead of the planned release time on Wednesday 21 October, enabling us to begin installing updates early.<\/p>\n Within a few hours, the necessary patches had been applied across our own hosting servers and the client servers that we fully manage, apart from a small number of exceptions involving infrastructure supplied by third-party providers.<\/strong><\/p>\n Additional server software updates became available during Thursday 22 October and overnight into Friday 23 October. These were also installed, regardless of whether they were directly related to the original PHP vulnerabilities.<\/p>\n Where third-party infrastructure, older software or unusual server configurations have created additional complications, we have worked to address these and communicate any outstanding requirements to the clients concerned.<\/p>\n We have also contacted our clients to explain the vulnerabilities, outline the action we have taken across the different services we provide and advise them of anything they may need to do themselves.<\/p>\n At the time of publication, we have found no evidence of successful attacks affecting our own services or the client websites that we manage.<\/strong> Nevertheless, we continue to monitor the situation closely, particularly given the high level of attempted exploitation being reported worldwide.<\/p>\n This week’s events provide a particularly clear reminder of why software updates are essential to website security.<\/p>\n When people think about keeping a website updated, they often think of installing the latest WordPress version, updating plugins or applying updates to their website’s theme.<\/p>\n These are all very important tasks, but they are only part of the picture.<\/p>\n A website relies on several layers of technology working together. These can include:<\/p>\n A vulnerability in any one of these layers can potentially put a website or server at risk, regardless of how carefully the other layers have been maintained.<\/p>\n The PHP vulnerabilities announced this week demonstrate that keeping a website’s own software up to date is not enough on its own. The surrounding hosting infrastructure must also be maintained and secured.<\/strong><\/p>\n For website owners, this makes it important to understand who is responsible for each part of their website’s maintenance.<\/p>\n Depending on the hosting and website management arrangements, responsibility might sit with the hosting company, the website developer, an IT support provider or the website owner themselves.<\/p>\n Regular security updates, supported software versions, reliable backups and appropriate monitoring all contribute to a website’s overall security.<\/p>\n No hosting provider or website owner can guarantee that new vulnerabilities will never be discovered. However, keeping software supported and regularly updated, and responding promptly when security issues arise, can significantly reduce the risk.<\/p>\n If your website is hosted and managed by Enbecom, we have already taken action in relation to the services under our management and contacted clients with relevant information and any further steps required.<\/p>\n If your website is hosted elsewhere, or you manage your own server, we strongly recommend checking the situation with your hosting provider or server administrator as soon as possible.<\/p>\n In particular, website owners should:<\/p>\n If you are unsure whether your hosting provider has taken action, we recommend contacting them directly and asking for confirmation.<\/p>\n If a vulnerable server cannot be updated immediately, the NCSC advises considering temporary protective measures, including taking affected systems offline where necessary until they can be secured.<\/p>\n Remember that owning or registering a domain name does not, in itself, mean you are affected. These vulnerabilities concern servers running PHP, rather than domain registration or ordinary email services.<\/p>\n For further details about the vulnerabilities and the recommended security updates, the following official resources provide useful information:<\/p>\n The discovery of critical vulnerabilities in widely used software is an unfortunate reality of modern technology. What matters is how quickly and effectively those vulnerabilities are addressed.<\/p>\n At Enbecom, our approach is to maintain supported and regularly updated hosting infrastructure, monitor important security developments and act promptly when new threats emerge.<\/p>\n The events of this week highlight why that work is so important, and why website security needs to be considered across the entire hosting environment, rather than just the website itself.<\/p>\n We will continue monitoring developments relating to these PHP vulnerabilities and applying any further updates necessary to protect the services we manage.<\/p>\n Enbecom clients with any questions about these vulnerabilities or the services we provide can get in touch with our support team by submitting a support request through their Enbecom Account<\/a>.<\/strong><\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":"Which PHP versions are affected?<\/h2>\n
\n
How did Enbecom respond?<\/h2>\n
Why keeping website software updated is so important<\/h2>\n
\n
What should website owners do now?<\/h2>\n
\n
Further information<\/h2>\n
\n
Our continuing commitment to security<\/h2>\n