Critical PHP fixes released this week highlight the need to check website hosting updates as well as website plugins and content.

The PHP project released urgent security updates on 21 October 2026 to address two critical vulnerabilities. Under certain conditions, the flaws could allow an attacker to execute code on a server without logging in.

The PHP Foundation identified fixed releases as PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. CERT-EU has advised organisations to patch affected systems immediately. These are the fixed versions announced on 21 October; hosting providers may subsequently supply newer releases or distribution-specific security patches.

Why this matters to your business

PHP runs on the server behind many business websites, including WordPress sites. A website may appear to work normally while the underlying hosting software still needs attention. Updating website content, themes or plugins alone does not establish that the server’s PHP vulnerabilities have been fixed.

Ask your hosting provider to confirm protection

CIT recommends asking your hosting provider or website developer whether your site’s PHP installation is affected and whether the relevant fixes have been applied. Request confirmation for each hosted site, including older or less frequently used installations.

If a change of PHP version is required, arrange a current backup and appropriate compatibility checks. Managed hosting customers should still obtain confirmation that the provider has completed the necessary work. Avoid assuming that automatic website updates also cover the hosting environment.

Contact CIT if you need help coordinating checks with your hosting provider or website developer.