You may have seen reports about critical PHP security flaws, with some organisations taking their websites offline as a precaution. For business owners, the immediate question is simple: does my website need attention?
Security fixes are now available. The priority is to confirm that your website’s hosting has received the relevant updates, and that any changes are compatible with your website.
What is PHP, and what has happened?
PHP is software that runs behind the scenes on a web server. It helps websites display content, access databases and process information. WordPress and many other website platforms rely on it.
Two critical vulnerabilities have been discovered that could allow attackers to run malicious code on affected servers without logging in. That could put website files and sensitive information at risk. Having a vulnerable installation does not automatically mean a website has been hacked.
Does updating WordPress fix it?
No. These vulnerabilities affect the PHP software running on your hosting, so updating WordPress, themes or plugins alone will not resolve them.
The PHP security fixes need to be applied by your hosting provider or whoever manages your server. WordPress has confirmed that no WordPress update is required for these specific vulnerabilities.
What is Footprint doing?
Our next step is to check that the websites we host are running a supported PHP version with the relevant security fixes. We are working with our hosting provider, 20i, to confirm protection.
We will assess the most appropriate PHP version for each website. Moving straight to the newest version can cause compatibility problems with older themes, plugins or custom functionality. So for each site we will:
- check compatibility before anything changes
- confirm backups are in place
- test the key features afterwards, including contact forms, bookings and online purchases where they apply
The aim is to apply the necessary security protection while keeping your website working properly.
What should website owners do?
1. Check with your hosting provider
Ask your provider whether it has applied the fixes for CVE-2026-109618 and CVE-2026-109619 to the PHP installation serving your website.
The PHP project released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some providers supply the fixes through their own maintained packages, so confirmation from your host matters more than simply checking a version number.
2. Find out which PHP version your website uses
If you use WordPress, look under Tools → Site Health → Info → Server. Your hosting control panel may also show this information. Use it as a starting point for a conversation with your hosting provider or website team.
3. Arrange any changes carefully
Ask your website team to check compatibility and confirm a recent backup before changing PHP versions. Afterwards, test the pages and features your customers rely on.
A website loading normally does not prove that it has received the security fixes.
4. Act promptly if protection cannot be confirmed
The UK’s National Cyber Security Centre recommends immediate action. If an update cannot be applied, your provider should assess the official temporary mitigations. Where these cannot be implemented promptly, taking the affected system offline may be necessary until it can be protected.
Want us to check your website?
You do not need to understand PHP to get this checked. If you are unsure which version your website uses, whether the security fixes have been applied, or how an update might affect your site, get in touch with Footprint.
We can review your website and hosting setup, help confirm its patch status and explain any action needed in plain English.