Website security is something we take seriously at CMS Live. It isn't just about installing updates when they become available. It's about keeping an eye on what's happening behind the scenes, understanding emerging threats and being ready to act when something needs attention.

This week, two critical security vulnerabilities were identified in PHP, the programming language that powers WordPress and other popular website platforms. The news has understandably prompted questions from website owners about whether their sites are affected and whether they need to take action.

Here's what happened, what we did to protect the websites we host, and why proactive hosting management matters.

What are the PHP security vulnerabilities?

PHP is the underlying programming language used by WordPress. It runs behind the scenes, processing information and helping your website function.

On 21 October 2026, security patches were publicly released to address two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619.

If left unpatched, these vulnerabilities could potentially allow attackers to execute malicious code without logging in, putting websites and their data at risk.

Importantly, this is a server-level security issue. Updating WordPress itself or installing the latest versions of your plugins does not resolve these vulnerabilities. The underlying PHP installation needs to be secured.

That means your hosting provider has an important role to play.

How quickly did CMS Live respond?

The PHP security patches were installed on our hosting infrastructure within 15 minutes of their public release.

We were monitoring the situation and had already deployed additional firewall protection through Cloudflare approximately 24 hours before the vulnerability became publicly known.

When the official PHP patches were released at 3pm on Wednesday 21 October, we applied the updates to our hosting by 3.15pm.

We didn't wait for clients to contact us or ask whether their websites were protected. We took action.

The websites we manage are monitored and maintained as part of our ongoing hosting and support service. Responding to security developments like this is part of that responsibility.

Which PHP versions are affected?

The vulnerabilities affected multiple PHP branches, so it was important to check the relevant versions rather than assume that running a particular major version was sufficient.

The patched versions are:

Applying the appropriate security patch is essential, including for older PHP branches that remain in use.

Our hosted environment was updated accordingly. Websites running PHP 8.5, for example, are using the patched PHP 8.5.12 release.

Security isn't just about installing updates

Applying a patch quickly is important, but good website security involves more than a single update.

As an additional precaution, we use Cloudflare's firewall protection and deployed extra firewall rules before the vulnerability became publicly known.

This provided another layer of protection while the situation developed and the official patches became available.

Our approach combines proactive monitoring, appropriate security measures and prompt action when updates are needed.

We also keep an eye on the wider technical environment in which our clients' websites operate. A website can have the latest WordPress core and plugins installed and still face risks if the underlying server software isn't properly maintained.

That's one of the reasons we believe managed hosting and ongoing technical support are so important.

Do CMS Live clients need to do anything?

For clients whose websites are hosted and managed by CMS Live, we have already applied the relevant PHP security patches. No action is required from you in response to these vulnerabilities.

We have seen no signs of issues associated with these vulnerabilities on the websites covered by our checks, and our security measures remain in place.

If you've received a security alert or an email about these PHP vulnerabilities, there's no need to panic. It's sensible to check that your hosting provider has addressed the issue, but receiving an alert doesn't automatically mean your website has been compromised.

If your website is hosted elsewhere, we recommend contacting your hosting provider to confirm that the appropriate patches have been applied to your PHP version.

Remember, updating WordPress and its plugins alone is not enough to resolve a vulnerability in the underlying PHP software.

Why managed website hosting matters

When you run a business, you have enough to think about without having to keep track of security advisories, server updates and emerging technical threats.

That's where having a hosting provider who actively manages your website makes a difference.

At CMS Live, we look after the technical side of our clients' websites, including hosting, security and ongoing maintenance. We monitor developments, apply appropriate updates and take action when issues arise.

Our aim is straightforward: to keep your website secure, reliable and running as it should, while giving you confidence that someone is looking after the things you don't necessarily see.

This week's PHP vulnerabilities are a good example. Our clients didn't need to understand the technical details or work out which PHP version they were running. We handled the necessary updates as part of managing their hosting.

Good website security often means dealing with problems before your clients even know they exist.

Looking for website hosting with ongoing support?

If you're concerned about your current hosting arrangements, or you're unsure who looks after the technical security of your website, it's worth asking a few questions.

• Is your PHP software kept up to date with security patches?

• Does your hosting provider monitor emerging security issues?

• Are additional security measures in place to help protect your website?

• Who takes responsibility for applying updates when vulnerabilities are discovered?

If you don't know the answers, it might be time to review your hosting.

CMS Live provides managed website hosting, security and technical support for businesses that want their websites properly looked after.

We believe hosting should be about more than simply providing server space. It should give you confidence that your website is being actively managed by people who understand how it works and take its security seriously.

Want to know more about our hosting and support services?

Visit CMS Live Hosting to find out more, or contact CMS Live if you'd like to discuss your current hosting arrangements.

We'll be happy to help.