PHP Security Update: What’s happened and how we’ve protected our customers
You may have seen reports about two critical security vulnerabilities affecting PHP, the technology behind many websites, including WordPress.
We wanted to explain what has happened, what it means for our customers, and the steps taken to address it.
The PHP security fixes have been applied to our shared website hosting platform. Customers with websites hosted on this platform do not need to change their PHP version or apply these server updates themselves.
What are the PHP vulnerabilities?
On 21 October, the PHP Security Team released security updates addressing CVE-2026-109618 and CVE-2026-109619.
Both vulnerabilities affect how PHP handles information in server memory. Under certain conditions, an attacker could exploit these weaknesses to run malicious code on an affected server without needing to log in.
CVE-2026-109618 involves memory corruption during the handling of an out-of-memory error. CVE-2026-109619 involves information from an earlier request remaining accessible after the memory supporting it has been released.
These are serious issues in PHP itself, which is why updating the underlying server software is essential. The PHP team has released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with hosting and software vendors also supplying patched builds. Official PHP security advisory.
What have we done?
Following the announcement, we reviewed the position for our hosted WordPress websites and checked the updates from Krystal, our hosting and server management provider.
Krystal introduced protective measures while the security patches were being made available, then rolled out the fixes overnight. By 6:38am on 22 October, patching had been completed across its shared, premium and reseller hosting fleet, covering the shared hosting platform used for our websites.
We confirmed the position that morning and updated our support team so they could respond to customer questions and tickets with clear information.
For customers on this platform, the PHP security updates have been handled at the hosting level. Krystal’s incident updates.
Why might the PHP version still look the same?
If you check WordPress Site Health or your hosting control panel, you may notice that the displayed PHP version has not changed.
Krystal has confirmed that the security fixes were backported into its existing PHP builds. This means the fixes have been applied while retaining the existing version number.
An unchanged version number therefore does not, by itself, mean the patch is missing. For our shared hosting platform, there is no need to switch PHP versions in response to this incident. Krystal’s explanation.
What about other websites and applications?
PHP is also used by other online services, so the checks extend beyond an organisation’s main website. The National Cyber Security Centre recommends identifying PHP-based systems and checking for updates from third-party software suppliers. NCSC guidance.
Applications hosted by another supplier need confirmation from that supplier. Updates to our website hosting do not automatically update a separate learning platform, parent engagement system or other cloud service.
If you receive a supplier notification or have a question about an application your school or organisation uses, send it through to our support team. We’re happy to help establish who manages it and what confirmation is needed.
Do our customers need to do anything?
For websites on our shared hosting platform, no customer action is required to apply these PHP fixes.
If your website is hosted elsewhere, check with your hosting provider. For other online applications, ask the supplier to confirm whether both vulnerabilities have been addressed.
If you notice a website problem or are unsure whether a notification applies to you, please raise a support ticket. We’ll be happy to look into it.
