When a hosting provider says a security issue has been addressed and no action is required, most companies take that as good news and move on. It’s a reasonable response, but depending on how a website is managed, there may be more to the story.
On October 21, 2026, two critical vulnerabilities in PHP prompted emergency security updates affecting technology used by millions of websites, including those built on WordPress, Drupal and Joomla. The incident raises an important question for website owners. How can you be certain your particular website has been protected?
What happened with PHP
PHP is a programming language that runs behind the scenes, handling many of the functions that keep websites operating.
The emergency PHP security releases addressed two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated critical with severity scores of 9.2 out of 10. Researchers at Wiz demonstrated how attackers could exploit these flaws to run commands on vulnerable servers without logging in, potentially exposing sensitive information.
Because the vulnerabilities exist within PHP itself, even a well-maintained website may be at risk if its underlying server software hasn’t been patched. For companies that depend on their websites to communicate with investors and customers, a security incident could disrupt access to important information and damage confidence.
Why a hosting provider’s assurance deserves a closer look
Many hosting companies responded quickly, applying patches and additional safeguards. For customers on fully managed platforms, the necessary work may already be complete.
Other hosting arrangements are less straightforward. Through our work managing corporate websites, we’ve seen how responsibilities can be divided among hosting providers, internal IT departments and website management teams. A hosting company may handle server updates while another party manages the website’s software and integrations. When a vulnerability affects multiple components, it’s not always clear who is responsible.
Some websites also use older PHP versions requiring special patches or upgrades. Others may have applications containing separate PHP installations. Firewalls can help reduce exposure, but as outlined in CISA’s security guidance, they don’t replace the need to correct the underlying vulnerability.
Website owners don’t need to manage these technical details personally, but they should know who is responsible and how the work is verified.
Five questions worth asking your hosting provider
If you’ve received a security notice or aren’t certain whether your website has been updated, request written confirmation of the following.
- Which PHP version is our website running, and has it been patched? Confirm that it includes the October 21 fixes or an equivalent vendor-supported patch.
- When was the update completed, and was the live server checked? Make sure the corrected software is running, not simply installed.
- Is our PHP version still supported? Older versions may no longer receive regular security updates.
- Are other applications or components using PHP? Separate installations may also require attention.
- Who is responsible for verifying our website’s security? Clarify the roles of your hosting provider, IT department and website management team.
Clear, documented answers are more useful than a general assurance that everything has been handled.
Checking your website’s PHP version
For WordPress websites, the PHP version can typically be found under Tools > Site Health > Info > Server in the administrative dashboard.
The October 21 updates included corrected PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Earlier releases within these branches generally need updating, although some hosting providers apply security patches without changing the displayed version number.
Checking the version is a useful starting point. Your hosting or technical team should confirm that the appropriate fixes are active.
Keeping website security from becoming an assumption
The PHP incident highlights a common challenge in corporate website management. Companies often rely on several providers and internal teams, yet responsibilities aren’t always clearly defined.
A reliable maintenance process should identify who tracks security updates, coordinates necessary changes and verifies that the live website is protected. This is especially important for corporate and investor relations websites, where continued access to information matters.
If your hosting provider has already resolved the PHP vulnerabilities, ask for confirmation and keep it on file. It’s a simple practice that helps prevent important security issues from being overlooked.