Last week, one of the biggest web security stories in years broke. Reporting said two critical flaws had been found in PHP, the programming language behind a large share of the internet, and that sites around the world were at risk.
You don’t need to be technical to act on this. Here’s the plain-language version.
What happened
PHP published details of two serious vulnerabilities, reported as CVE-2026-109618 and CVE-2026-109619, and released emergency fixes within days. Both were rated critical. In the worst case, a flaw like this can let an attacker take control of a website’s server. Reports say AI-assisted research helped uncover the problems.
The headline number is that PHP runs about 70% of websites. That’s a widely repeated estimate rather than a precise count, and how many sites were actually vulnerable isn’t clear. Some sites, including public-sector sites, briefly went offline while they applied the fixes.
Why a marketer is talking about this
Your website is the center of your brand. If it’s hacked, redirected or taken offline, your customers don’t blame a programming language. They blame you. Security is part of reputation.
Does this affect you?
If your website runs on WordPress, or was built with a PHP-based tool, then it likely uses PHP. Many website builders, e-commerce platforms and hosting plans do as well. Our own website is built as static pages and doesn’t run PHP.
What to do this week
- Ask your host or developer. Is my site running PHP? Was it affected? Has it been updated?
- Confirm the PHP update. Reports list the patched versions as 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Your host can apply these for you.
- Update your website platform and plugins. Outdated software is where most attacks begin.
- Back up your site and make sure the backup can actually be restored.
- Be wary of scam emails. Headlines like this attract phishing. Don’t click anything that claims to fix your site.
- If you’re on an old, unsupported PHP version, ask your provider how it will be protected or replaced.
The bigger lesson
A website isn’t something you build once and forget. It needs updates, monitoring and a plan, just like any other part of your business. A fast, simple, well-maintained site is a marketing asset. A neglected one is a liability.
These details are drawn from press reports at the time of writing and may change. Confirm specifics with your hosting provider or developer.
Sources: The National CIO Review and TechRadar.
