A website can look perfectly normal while the software behind it needs an urgent update. The recent PHP security alert is a reminder to check who maintains the technology your business relies on.
What happened?
On 21 October, PHP released fixes for two critical flaws that could let an attacker run code on a vulnerable server without a password. The UK’s National Cyber Security Centre advises organisations to identify affected systems and update promptly.
Later official analysis found exploitation more complex than initially feared. Patching remains the recommended action; a vulnerability announcement alone does not establish that your website has been breached.
Five checks worth making today
WordPress runs on PHP. Updating WordPress, themes or plugins is separate from updating the PHP runtime, which is managed through your hosting provider.
1. Find out what you run. Ask your host whether your website, old subdomains or business tools use PHP. Confirm who is responsible for updates.
2. Get evidence of the fix. Ask for the PHP version serving your website and confirmation that these specific flaws are patched, including any vendor backported fix.
3. Check the business still works. Arrange a backup before changes. Afterwards, test the journeys that matter: enquiries, account login, bookings and checkout.
4. Deal with delays safely. If patching cannot happen promptly, ask your provider to follow official mitigation guidance and assess whether the affected service should be taken offline. Suspected compromise needs investigation.
5. Make maintenance routine. Keep a simple record of your systems, their owners and update responsibilities. Follow vendor security notices and agree how urgent fixes will be handled.
A message to send your hosting provider
Please confirm whether our website uses PHP, which version serves live requests, and whether the October 2026 PHP security fixes are applied. Please also confirm whether the 23 October follow-up advisory requires action on our setup.
Watch out for “security fix” scams
Be cautious of unexpected messages offering an urgent “security fix”. Verify requests through your provider’s usual contact details. Never send passwords or banking details in reply to suspicious messages. UK users can forward suspicious emails to report@phishing.gov.uk.
How we responded at ClubOS
For ClubOS, our review of application code, dependencies and deployment configuration identified no PHP component and no direct exposure to these vulnerabilities. We continue to review security alerts and maintain the platform. Access controls, updates and ongoing checks remain part of protecting customers’ information.
Technical details for your IT provider
The original issues are CVE-2026-109618 and CVE-2026-109619, rated critical at CVSS 9.2. Branch fixes are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or appropriate vendor-patched packages. On 23 October, PHP also published configuration-specific guidance for CVE-2026-115560. Your provider should check both advisories.
Guidance checked against the official sources below on 26 October 2026. Check current vendor advice before applying changes.
Want to discuss this area?
Unsure what your website depends on?
Bytecode Consulting helps businesses assess their systems, understand dependencies and plan practical improvements. Tell us which website or system you want to review, and we can discuss an appropriate next step.