If your website runs on PHP, and most do, then the software underneath your site needs an update this week. The work itself is not yours to do. It belongs to whoever hosts your site. What you can do today is ask the question and get a straight answer.
Two serious flaws in PHP were published on October 21, 2026. They matter to business owners for one specific reason: they sit in the language the site runs on, not in your own pages, so a well built site is exposed the same as a neglected one. Nothing you did wrong, and nothing you can fix from the admin screen.
What actually happened?
PHP released emergency updates for two flaws that allow an attacker to run code on a web server without logging in. They are tracked as CVE-2026-109618 and CVE-2026-109619 and carry a severity rating of 9.2 out of 10. The corrected versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the problem reaches back through almost every older release.
You can see the fixed releases on the official PHP changelog, and Help Net Security’s summary covers the timeline and the urgency. Both are worth forwarding to whoever maintains your site.
Does this affect my site?
Probably, in the sense that it affects the software your site sits on. PHP runs a large share of the web, including WordPress, so the reasonable assumption is that it applies to you until someone confirms otherwise.
The more useful question is whether it has already been handled. Many hosts patch this kind of thing centrally within a day and never mention it. Some do not. The difference is worth knowing before you need it.
Who is responsible for fixing it?
Your host. Not your designer, and not the company you bought the domain from.
This is the part that catches people out. The company that built your site and the company whose server it runs on are often two different businesses, and the update here happens on the server. A designer can be excellent and still have no ability to patch the machine. If those are separate companies for you, the message goes to the host.
If you are not certain which is which, that is common, and it is worth sorting out while nothing is on fire. Our guide to how a website actually gets online explains the five pieces in plain words: the domain, the registrar, the name servers, the host, and your email. They can all sit at different companies, and usually do.
What should I send them?
Keep it short. A capable host will answer in a sentence.
- Are our sites affected by the PHP vulnerabilities published on October 21, 2026?
- Which PHP version are we running, and has it been updated to a corrected release?
- If not yet, when will that happen?
- Are any of our sites on a PHP version that no longer receives security updates?
That last question is the one most worth asking, and not only this week. Older PHP releases stop receiving fixes entirely. When that happens, there is no update to install and the only real answer is to move the site to a supported version. That is a planned project, not an emergency repair, which is exactly why it is better to discover it now.
What if the answer is unclear?
A long silence, or an answer that does not name a version, tells you something about how the site is being looked after. It does not necessarily mean you have been exposed. It does mean nobody is going to tell you next time either.
Weber maintains sites we built and sites other people built, across WordPress and custom systems. Part of that work is the unglamorous side: keeping the software underneath current and telling clients plainly where things stand. For the we built a WordPress site the board updates itself, while the platform underneath stays our responsibility. Knowing which half is whose is the point.
If you are not sure who to send those questions to, or you would rather someone else chased the answer, tell us the web address and we will help you work out where your site actually lives and who maintains it. You can also read more about our website services.
We used AI tools to help research and draft this article.
