A customer tries to open your company's website and gets an error. Your office manager contacts the person who built it, but that person is busy. The hosting company says the server software needs attention, and nobody in the office knows whether the latest security updates were installed.
A business website may not be the first thing you think about when reviewing cybersecurity. You may focus on employee computers, email, and backups. But the website is another system people rely on. If it is vulnerable, the consequences can include downtime, unauthorized changes, and possible exposure of information handled by the site.
On October 21, 2026, the PHP project released urgent fixes for two critical security vulnerabilities. PHP is the programming language that runs much of the behind-the-scenes work on WordPress websites and other web applications. The vulnerabilities could, under certain conditions, allow an outside attacker to run code on a vulnerable server without signing in.
The practical next step is to confirm whether your website uses PHP, which version is running, and whether your hosting provider has applied the security fix. Updating WordPress alone does not resolve these particular PHP flaws.
For small and midsize businesses in Tampa Bay, the important question is not whether you understand server software. It is whether someone is responsible for keeping the website's underlying systems secure.
What happened with the October 2026 PHP security update?
The PHP security team identified two critical vulnerabilities, listed as CVE-2026-109618 and CVE-2026-109619. A CVE number is a public identifier used to track a particular security weakness. Both issues involve the way PHP handles certain internal operations while processing website requests.
The weaknesses may allow remote code execution, often shortened to RCE. That means an attacker may be able to make vulnerable server software run commands or programs it was not supposed to run. In this case, the PHP team warned that some attacks could be triggered without the attacker having a user account or password.
This is a serious software problem. It is not evidence that every WordPress website was hacked, or that every business website is vulnerable. The actual exposure depends on the server software, versions, and configuration.
The PHP project's October 21, 2026 security advisory identifies these corrected releases:
- PHP 8.5: update to 8.5.12 or a later corrected release.
- PHP 8.4: update to 8.4.27 or a later corrected release.
- PHP 8.3: update to 8.3.36 or a later corrected release.
- PHP 8.2: update to 8.2.35 or a later corrected release.
If your provider uses a specially maintained operating-system package, the security fix may be included through a vendor update rather than through the version number you expect. Ask the provider to identify the package and confirm that both vulnerabilities have been addressed.
Versions 8.1 and older no longer receive routine security releases directly from the PHP project. Some operating-system vendors maintain security fixes for older packages, but that must be verified rather than assumed. PHP also notes that version 8.2 reaches the end of its upstream security support on December 31, 2026, so an upgrade plan still matters even after the urgent fix.
The original Cybernews report covered the warnings as the emergency release approached. The fixes are now available. Business owners should act on the current official guidance, not wait for patches that have already been issued.
Is this a WordPress problem or a hosting problem?
It is primarily a PHP server software problem, not a defect that can be fixed by clicking the normal WordPress update button.
WordPress uses PHP to create pages, process forms, and communicate with the website's database. Your hosting provider supplies the server environment where that PHP code runs. A WordPress website can have its themes, plugins, and WordPress software fully updated while the PHP version underneath remains out of date.
The WordPress project's October 21 security notice explicitly says that no WordPress software update is required or planned for these two PHP vulnerabilities. PHP must be corrected at the hosting or server level.
This distinction matters because business websites commonly involve several different people or companies:
- Website designer or developer: builds the pages and may maintain WordPress, plugins, and themes.
- Web hosting provider: operates the server and may control PHP updates.
- Domain registrar: manages registration of your website address, which is a different responsibility.
- Business owner: should know who is accountable for updates, backups, and recovery.
Sometimes one vendor handles all of these tasks. Sometimes each is managed separately. The problem arises when everyone assumes someone else owns the PHP updates.
A simple question can resolve much of the confusion: Who manages the PHP version for our website, and how will you confirm the October 21 fixes are installed?
How can you check the PHP version on your WordPress website?
If you have access to the WordPress administration area, you can often find the answer without installing another tool.
WordPress recommends these steps:
- Sign in to your WordPress dashboard using your normal administration account.
- Open Tools, then Site Health.
- Select the Info tab.
- Expand the Server section.
- Look for the PHP version entry and record what it says.
You can also ask the hosting provider to identify the version in its customer dashboard. If you do not have administrator access, do not create unnecessary accounts or install an unfamiliar plugin just to obtain this information. Ask the person who manages your website.
The version number is a starting point, not the entire security assessment. The server may have multiple PHP versions installed, different websites may use different versions, or a hosting vendor may have applied a security backport. A backport is a security correction added to an older software release while retaining that release's version family.
Ask your provider to confirm the version actually serving your website, not merely the default version advertised by the hosting plan. If the provider says the server is patched but the version appears older, request a clear explanation of which vendor update covers the two CVE numbers.
Keep that answer in your business records. You should not need to repeat the same investigation the next time an urgent website security notice appears.
What should you ask your hosting company today?
A short, specific request is better than a vague message asking whether the website is safe. The hosting company should be able to identify the technology it maintains and explain what it has changed.
Ask for confirmation of these items:
- Current PHP version: What release is actively processing requests for our website?
- Security fix: Have CVE-2026-109618 and CVE-2026-109619 both been addressed?
- Update responsibility: Who installs and verifies future PHP security updates?
- Timing and status: Has the change already been completed, or is there still work outstanding?
- Compatibility checks: Were forms, shopping carts, logins, and other important features tested afterward?
- Backup and recovery: Is there a usable recent backup if an update causes a problem?
- Other installations: Are older subdomains, test sites, or additional business applications also running PHP?
You can send a plain message such as this:
Please confirm the PHP version currently used by our business website and whether the October 21, 2026 fixes for CVE-2026-109618 and CVE-2026-109619 have been installed. If you use vendor backported patches, please identify the applicable update. Also confirm whether our website was tested after patching and who is responsible for future PHP security releases.
If you receive only a general reply that the hosting plan includes security, ask for the version and fix confirmation again. General security features do not establish that these particular vulnerabilities were corrected.
What if your website is using an older version of PHP?
An outdated version calls for action, but the right next step depends on who controls the server and whether a supported upgrade is compatible with the website.
Begin by contacting the hosting provider or developer. Ask them to determine whether your website is affected and prepare the appropriate update. If you are on managed hosting, the provider may already be coordinating changes across customer websites.
For an older WordPress installation, a major PHP upgrade can expose compatibility problems in themes, plugins, or custom website features. That does not mean you should postpone security work indefinitely. It means the update should be planned and tested by someone who understands the site.
A sensible process includes:
- Confirm a recent backup of the website files and database.
- Check compatibility of the installed WordPress version, themes, plugins, and custom functions.
- Apply the corrected PHP package or migrate to a supported PHP release.
- Test the functions that matter to your business, especially customer inquiries, payments, and bookings.
- Document the corrected version and the date of the update.
If patching cannot be completed quickly, ask the provider how the vulnerable server can be isolated or otherwise protected while an urgent remediation plan is carried out. A web application firewall, or WAF, is a service that filters suspicious website requests, but it does not replace installing the PHP fix. The PHP advisory says temporary measures do not provide complete protection.
Where a vulnerable internet-facing server cannot be adequately secured, taking it temporarily offline may be safer than leaving it exposed. That decision should be made with the hosting provider based on the site's actual risk and importance to the business.
How do you know the website still works after the update?
Installing a security update is necessary, but it is not the end of the job. The provider should verify that the corrected software is in use and that important website features still operate normally.
A website can look fine on its home page while a contact form is failing quietly. That is a business problem because customer inquiries might not arrive, and nobody notices until an expected message or order is missing.
Check the activities visitors actually perform:
- Open the main pages on a phone and a computer.
- Submit a test contact form and confirm the message arrives at the right email address.
- Check appointment or booking functions, if the website uses them.
- Test customer logins and other account features, where applicable.
- Review shopping-cart and checkout functions if the website accepts online orders.
- Ask the provider to inspect error logs, which record software problems that visitors may not see.
- Confirm backups remain usable after the server change.
If a checkout or payment flow is involved, use the payment provider's approved test method rather than making unnecessary real transactions.
Keep a brief update record: who did the work, what changed, what was tested, and any remaining issues. This creates accountability without requiring you to understand the technical details.
Does a patched website mean there is nothing else to review?
No. The urgent PHP update addresses two specific vulnerabilities. A business website still depends on other software, accounts, and maintenance practices.
For example, a fully patched PHP server may still run an outdated WordPress plugin, use weak administrator passwords, or have no reliable backup. Those are separate problems requiring separate attention.
Once the emergency update is confirmed, review a manageable set of website basics:
- WordPress maintenance: Are the platform, themes, and plugins kept current?
- Account access: Do only authorized people have website administration access?
- Multifactor authentication: Is an additional sign-in check available for administrator accounts?
- Backups: Are website files and the database backed up, with a tested way to restore them?
- Monitoring: Would somebody notice if the website went down or started showing unusual errors?
- Vendor records: Do you know the hosting company, domain registrar, and developer contacts?
- Old websites: Are unused staging sites, former campaign pages, and neglected subdomains still online?
A staging site is a private or test copy of a website used to try changes before they reach customers. It can be useful, but an abandoned test copy can become a security liability if nobody maintains it.
Do not assume every security alert means your business has been attacked. Equally, do not assume that a working homepage proves everything is secure. The goal is to know what is running, who maintains it, and what happens when a serious issue is announced.
Who should own website security when several vendors are involved?
Many smaller businesses have no single person responsible for the entire website. A developer may update WordPress, a hosting company may update PHP, an office manager may pay the domain renewal, and an IT provider may manage business email.
Each responsibility is reasonable on its own. The gap appears when no one checks that the work connects.
Write down a simple ownership record with these details:
- Website hosting: provider name, support contact, and account owner.
- PHP and server updates: the vendor responsible for applying them.
- WordPress maintenance: who reviews core software, plugins, and themes.
- Website backups: where they are stored and who can restore them.
- Domain renewal: who controls the registration and payment method.
- Incident contact: whom staff should call if the site behaves unexpectedly.
Your business should retain access to its own accounts and documentation. Avoid relying on one former employee or contractor to hold all the important credentials.
The same principle applies to other business systems. Our guide to what a business IT assessment should include explains why ownership, inventories, backup checks, and support responsibilities deserve attention before something breaks.
How Inventive Tech Solutions helps with website-related security risks
Inventive Tech Solutions helps small and midsize businesses across St. Petersburg, Clearwater, South Pasadena, and the surrounding Tampa Bay area understand the technology risks that can interrupt daily work.
For a notice like this one, the starting point is clarity. We can help you review how technology responsibilities are documented, identify the right vendor contacts, and look at whether website-related risks fit into the broader picture of your business security. Website hosting, server management, and direct PHP patching should be confirmed with the provider responsible for those services rather than assumed to be part of a general IT support plan.
Depending on your environment, a practical review may cover:
- Who owns each account connected to your business website and online services.
- Which vendors handle updates and how their work is verified.
- How website incidents are reported and escalated when staff notice a problem.
- Whether backups and recovery plans are documented for important business systems.
- How the website fits into your wider security practices, including account access and business continuity.
We will explain findings in plain language and help distinguish urgent security work from longer-term improvements. The aim is not to sell a new service because an alarming headline appeared. It is to know what needs attention, who can address it, and how to avoid the same uncertainty next time.
Frequently asked questions
Does updating WordPress fix the October 2026 PHP vulnerabilities?
No. These two vulnerabilities are in PHP itself. The WordPress project says no WordPress software update is required for these specific issues. Your hosting provider or server administrator needs to confirm the PHP security fix.
Which PHP versions contain the October 21 security fixes?
The PHP project issued corrected versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. A provider may also apply an appropriate security backport through its operating-system vendor. Ask for confirmation covering both CVE numbers.
Can I check my PHP version without being a web developer?
Usually. In WordPress, go to Tools > Site Health > Info > Server. If you do not have access or the information is unclear, ask your website administrator or hosting company to confirm the active PHP version.
Are all WordPress websites vulnerable to these flaws?
No. The issue depends on the underlying PHP version, the server environment, and whether the necessary fixes have been applied. A WordPress website being online does not establish that it is vulnerable or compromised.
What should I do if my hosting company cannot patch immediately?
Ask for an urgent explanation of the risk, available isolation measures, and the plan to install and verify the fix. Temporary filtering is not a substitute for updating PHP. For a seriously exposed site, temporarily taking it offline may be appropriate.
Should we review anything after our host confirms the update?
Yes. Test your forms, customer-facing functions, and backup arrangements. Confirm that someone is responsible for future PHP updates, WordPress maintenance, and responding to website security notices.
Schedule a free IT assessment
If this security alert has made you wonder who is responsible for your website and other important technology, we can help you review the current setup, identify the real risks, and recommend practical next steps that fit your business. There is no obligation.
Schedule a free IT assessment with Inventive Tech Solutions through our contact page or call (727) 400-3903.