October 2026 PHP Security Alert: Is Your Business Website Protected?
Your website can look perfectly normal while the software behind it needs an important security update.
On October 21, PHP released fixes for two critical security vulnerabilities. For a business owner, the practical question is simple: has the right update reached your website, and who is checking?
That question is part of why I offer ongoing website care. You have a business to run. You should have someone who can turn a technical alert into a clear answer and a practical next step.
What happened—and why does it matter?
PHP powers the server-side functionality of many websites, including WordPress. The newly disclosed vulnerabilities, CVE-2026-109618 and CVE-2026-109619, can allow an attacker to run code on affected systems without signing in.
The PHP team released fixes in 8.2.35, 8.3.36, 8.4.27 and 8.5.12 and urged users to update. Some hosting providers deliver equivalent fixes through their own software packages. Read the official PHP advisory.
This affects software behind the website, so updating a WordPress plugin alone does not establish that the underlying PHP issue is resolved.
Does this affect 70% of websites?
You may see figures around 70% in coverage of this alert. There is a useful statistic behind that number: on October 21, W3Techs reported that PHP was used by 69.3% of websites whose server-side programming language it could identify. That measures PHP adoption—not how many websites were vulnerable or hacked. Source: W3Techs.
The takeaway for a business owner is that PHP is common enough to make checking worthwhile. A headline percentage cannot tell you the status of your own website.
What I checked in my own and client hosting accounts
After receiving Hostinger’s notice, I reviewed PHP information for multiple hosting environments across two providers, covering my own sites, client sites and separate staging or migration copies.
That review helped me connect the security announcement with the hosting setups behind the websites I work on. I checked the available PHP information, distinguished live sites from staging copies and reviewed the provider’s response.
For me, that is the value of ongoing attention: taking the next step after an alert arrives, instead of leaving the business owner to interpret it.
What Hostinger told me
In its October 22 update, Hostinger confirmed that PHP security fixes are installed on all its hosting servers except customer-managed VPS. Hostinger reports that its earlier protections blocked the known attacks; the completed PHP update fixes the underlying vulnerabilities. Customers on its managed hosting do not need to apply the patch themselves. VPS customers remain responsible for updating PHP and restarting it. Read Hostinger’s update.
The displayed PHP version may stay the same because Hostinger has incorporated fixes into existing builds. To check your managed hosting, open Websites → Dashboard → PHP Info: Hostinger says a Build Date of October 21, 2026 or later indicates the fix is installed.
That is the kind of communication and proactive response I value from a hosting provider. It gives business owners a clear explanation of what is happening and how their provider is responding.
As a Hostinger partner, I help connect that hosting support with the needs of your actual website: reviewing relevant notices, coordinating questions and checking affected functionality as part of our agreed care plan. Hostinger handles its infrastructure, while I help keep your website working for your business.
What should you do now?
You do not need to become a server administrator. Start with these three questions:
- Does my website use PHP, and who manages it? Your host or website provider should be able to explain this.
- Has the fix been applied to the PHP serving my live website? Ask for the installed fixed version or confirmation of the provider’s equivalent patch.
- Who will check the website afterward? Important pages, forms and other customer functions deserve attention after changes.
Need someone to investigate? My Website Audits & Improvements service offers a focused, paid review to clarify what needs attention and scope the work to address it. We agree on the questions to investigate and the fee before work begins.
A good host and ongoing website care work together
Your host manages the infrastructure covered by its service. Your business still needs someone paying attention to how the website works for customers.
A contact form can look fine while inquiries fail to reach the right inbox. A hosting update can be complete while an important customer path still needs checking. These details matter because your website supports real inquiries, appointments and sales.
My website care and ongoing support can combine platform-appropriate updates, backup arrangements, agreed monitoring, troubleshooting and checks of affected functionality. We define the scope and response arrangements together.
For businesses that also want to grow, a monthly partnership can include content improvements, search visibility and better paths from a website visit to an inquiry.
You work directly with me, keep control of your hosting account and get a clear plan for what needs attention.
Considering Hostinger?
Hostinger is one option I can help you evaluate and manage when it fits your website. You do not need to change hosts to work with me.
If you are considering a new plan, explore Hostinger through my referral link, or ask me to help you choose before purchasing.
I may earn a commission if you purchase through this link.
Keep your website off your worry list.
If nobody is responsible for reviewing security notices, coordinating updates and checking your website afterward, this is a good time to put that support in place.
I help businesses in Reno, Sparks and beyond keep their websites maintained and working for customers. Together, we agree on an ongoing care plan suited to your website, with clear priorities, responsibilities and pricing.
Tell me about your website and the support you need. We can discuss whether ongoing care is the right fit.