The latest PHP vulnerabilities raise an important question for website owners: how quickly does your web host respond when a critical security issue emerges?
So, what happened?
Imagine if every house on your street had the same dodgy front door lock. Now imagine someone posted how to open it before the locksmith finishes making new locks. That’s what happened when the latest PHP vulnerabilities were discovered this week.
PHP is the programming language behind most websites. WordPress uses it. If you have a WordPress site, you’re using PHP, even if you didn’t realise it.
Here’s the timeline (Australian Dates)
- 21 October: Details of two serious PHP flaws leaked online before the PHP team was ready to release a fix.
- 22 October: PHP rushed the fix out early, landing just after midnight on Thursday morning.
- What’s the risk? Both flaws let an attacker run their own code on your web server without logging in. In other words, they could take over your site.
- How far does it go? The researchers who found these flaws say every PHP version from the last ten years is affected, all the way back to PHP 5.4.
And here’s the catch. PHP only released fixes for versions 8.2, 8.3, 8.4 and 8.5. Anything older is “end of life”, which means PHP doesn’t fix it anymore. Some of the companies that make hosting software (cPanel and CloudLinux) have built their own fixes for some older versions, but not all of them. And not all hosts use cPanel and CloudLinux. Sites on very old PHP may have no fix at all.
If you use shared hosting, you can’t patch PHP yourself. Your host has to do it for you. So, how your host responded this week is a good way to judge their service.
Six questions to ask your host this week
1. Did you hear from them at all?
This was big news in the tech world. A good host tells you what’s going on, in simple terms, before you have to ask. An email, a status page update, a note in your client area. If your inbox has been quiet, ask yourself why.
2. How quickly did they act?
The fix came out around midnight our time. Some hosts set up temporary protection even before the official fix was available. Others are still “looking into it.” Ask your host directly: when was my server patched? Getting it done in hours is good. Waiting days is not.
3. Is my site’s PHP actually patched?
You can check your PHP version in cPanel, usually under MultiPHP Manager or Select PHP Version. Then, ask your host in writing if your site is patched for both flaws (CVE-2026-109618 and CVE-2026-109619). A good host will give you a clear yes or no, and tell you when it was done. If their answer is vague, that tells you something too.
4. Are they still letting you run ancient PHP?
Plenty of hosts quietly let sites sit on PHP 7 for years, because it’s easier than having the awkward “your site needs an update” chat. Old PHP was already a risk. This week made it a much bigger one. If you’re on PHP 8.1 or older, ask: have you patched this version yourselves, or am I just exposed? And while you’re at it: did they ever warn you it was out of date?
5. What’s their plan for 31 December?
PHP 8.2 reaches end of life on 31 December 2026. Next time something like this happens, 8.2 won’t get an official fix either. Ask your host what happens then. Will they warn you? Help you upgrade? Or let you find out the hard way?
6. Did they help, or just hand you homework?
An email saying “please update your PHP version” isn’t much use to a florist or a plumber. Did your host offer to check your site works on a newer version, or move it for you? That’s the difference between a host and a landlord.
How we handled it at Domain Central
We’d be a bit cheeky writing all this without showing our own homework. So here it is.
- When we told customers: Status page updated, client area announcement and website banner put live in the early morning of Thursday 22nd Oct. Our sister brand Fluccs (which handles all of our group infrastructure) was updated at 4pm Wed 21st Oct.
- When servers were protected: We applied a temporary fix to all shared hosting servers across both brands by 5pm on 21st October. This was eight hours before any official patch was released.
- When servers were fully patched: Because of hosting control panels, we had to wait until vendor patches were released after 8am on Thursday, 22nd October. Once they were out and tested, we patched all shared servers by 11am that same morning.
- Older PHP versions: We currently support versions 5.6 and above on machines where vendors provide patches for those versions. All versions on all machines have been patched.
- Customers on old PHP: Over the next few weeks we will be reaching out to all hosting customers running PHP 8.1 or older with information on their current version and advice on upgrading to the newest PHP version and how we can help with that process.
The bottom line
You don’t need to understand memory corruption or CVE numbers or even what a PHP vulnerability is. What matters is whether the people looking after your website were there when it counted.
So ask the questions. If the answers are good, great, you’ve got a keeper. If the answers are vague, slow, or never arrive at all, that’s worth knowing too.
And if you don’t like what you hear, give us a yell. We’ll check your site, tell you what PHP it’s on, and help you move it over without the headache.
