This week the PHP team released emergency fixes for two critical security flaws (being called “PHP2Shell” in the tech press). PHP is the language behind around 69% of the world’s websites, according to W3Techs – and that includes every WordPress site. So if you have a WordPress website, this one affected you. How it was handled by whoever looks after your hosting says a lot about how safe your site really is.
What happened?
On 21 October 2026 PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Both are rated critical, and both allow remote code execution. In plain English, an attacker could send a single request to your website, without logging in, and run their own code on the server – before WordPress or any security plugin even gets a look in.
It affected practically every PHP setup that serves web pages, whichever way the server runs it. There’s no settings change that fully closes the hole either – updating PHP is the only complete fix. Worse still, there are reports of exploit attempts in the wild days before the fixes were made public, and PHP 8.1 and older don’t get an official patch at all.
So this wasn’t a “get round to it next week” kind of update. It was a drop-everything moment.
How I handled it
Sites hosted with me were updated within two minutes of the patched PHP versions being released. Not two days, not “in our next maintenance window” – two minutes.
And in fact they were protected before that. As soon as the issue became known I put measures in place to guard against the exploit, so my clients’ sites weren’t sitting there exposed while we waited for the fix to land. Once it did, the servers were patched, PHP was restarted so the fixed version was actually the one running, and everything carried on as normal.
My clients didn’t have to do anything. Most of them won’t even have known there was a problem – which is exactly how it should be. No downtime, no panic, no frantic emails.
Meanwhile, elsewhere…
Not everyone I work with hosts their site with me. Some clients use me for SEO or GEO (AI search) work but keep their hosting with another company. And at the time of writing, around 15% of those sites are offline.
Not hacked – switched off. Their hosts have decided that the easiest way to deal with the problem is to simply pull the plug, rather than sort it out in a timely, well-managed, proactive way.
To be clear, taking a server offline is better than leaving it open to attack. But it should be a last resort, not the plan. Those businesses are now losing enquiries and sales, their customers are seeing error pages, and their search rankings can start to suffer if it drags on. All because their host wasn’t ready.
Why the difference?
It comes down to how hosting is run. A lot of hosting companies are set up to run thousands of sites as cheaply as possible. When something like this happens, they’re slow to act, they don’t have anyone watching closely, and the safest option for them is to shut things down until they catch up.
I work differently. I host a smaller number of sites on UK-based servers that I manage closely, I keep an eye on security news as it breaks, and I know WordPress and PHP inside out. That means I can act straight away – and act carefully – instead of reaching for the off switch.
That’s the bit you’re really paying for with good hosting. Not disk space or bandwidth (although I have those, along with RAM and CPUs, in abundance), but having someone who’s on it the moment something goes wrong.
Is your site in safe hands?
If your site has been offline this week – or if you’ve no idea whether your host has patched PHP yet – it might be time for a change.
My WordPress support & maintenance packages include hosting as standard, along with daily backups stored off-site, WordPress, theme and plugin updates, and support hours each month. Some packages also include a full ongoing SEO and GEO (AI search) campaign. So when the next big security issue comes along – and there will be a next one – you can let me deal with it while you carry on running your business.
See the support & maintenance packages
Peter Mahoney
WordPress SEO & AI Search (GEO) Expert