If you've seen this week's headlines about websites being at risk of hacking, you're probably wondering whether yours is affected. You might also be wondering who is supposed to check: your hosting company, your developer or the person who manages your WordPress updates.
That's a reasonable question. Most business owners don't spend their day thinking about the software running on their web server.
I want to explain what's happened, what you should ask for now, and why this deserves a place on your marketing to-do list.
What happened with PHP this week?
The issue is commonly called PHP2Shell. It involves two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. PHP released security updates on October 21, 2026.
The concern is unauthenticated remote code execution. In plain English, an attacker could potentially make a vulnerable server run their code without first logging in. PHP's advisory treats all PHP installations serving web requests as at risk, although the attack paths and exposure vary. [1]
That makes this a serious security issue. It doesn't establish that your website has already been hacked.
The UK's National Cyber Security Centre recommends identifying PHP systems, applying the security updates and monitoring further vendor guidance. Its advice also includes considering taking affected systems offline when timely updates or temporary mitigations aren't possible. [2]
What is PHP, and why would your website use it?
PHP is software that runs on a web server. It helps applications generate pages, work with databases and handle behind-the-scenes tasks before sending content to your browser. [2]
You can run a business website for years without needing to know much about it. Your hosting provider or developer may manage that layer for you.
The important question now is who can confirm that the PHP installation actually serving your website has received the fix.
I'd start there. A general reassurance that “we keep everything updated” wouldn't answer my question.
Ask your hosting provider for a specific answer
You don't need to diagnose a server yourself. You need a clear response from whoever maintains it.
Here's what I'd send:
Can you confirm whether our website is affected by CVE-2026-109618 or CVE-2026-109619, and whether the PHP security fixes have been applied to the installation serving our site? Please also confirm whether today's follow-up PHP advisory requires any action.
The patched releases announced on October 21 were PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some vendors provide backported fixes, so a version number alone may not settle the question. Ask your provider to confirm the relevant patch status. [1]
Also ask them to check today's guidance. On October 23, PHP published a follow-up advisory about session upload progress and an unusual configuration-dependent attack path. Your administrator should assess that guidance alongside the original updates. [1]
This is why I'd date any confirmation and keep the response. Security guidance can develop after the first patch.
Updating WordPress isn't the same task
If your website uses WordPress, ask about PHP explicitly. A completed plugin update checklist doesn't tell you which PHP security patches your hosting provider has installed.
I would separate the questions:
- Has the hosting environment received the relevant PHP fixes?
- Are the website's own software, plugins and themes maintained?
- Has someone checked that the website works after the changes?
These are related responsibilities, but they need clear ownership. Otherwise, the developer assumes the host handled it, the host assumes the customer manages it, and you end up with no useful answer.
Why I'm talking about this on a marketing blog
Your website is where a lot of your marketing becomes a business enquiry.
Imagine you're paying to bring visitors to a service page. The ads are running, the budget is being spent, and someone is ready to contact you. If the page or enquiry form stops working, that opportunity can disappear.
That's the business reason I'd treat this as urgent.
I'd also review campaigns while technical work is happening. If a landing page is unavailable or the team can't confirm it's suitable for visitors, I'd consider pausing the ads pointing to it until the issue is resolved. That decision should reflect the site's actual condition.
Once the work is complete, test the customer journey:
- Open your main landing pages on desktop and mobile.
- Submit an enquiry and confirm it reaches the right inbox or CRM.
- Test booking or checkout where relevant.
- Confirm conversion tracking still records the intended actions.
A working homepage is only the beginning of that check.
What if there are signs of a compromise?
Unexpected changes, suspicious redirects or unfamiliar administrator accounts deserve investigation. They don't identify the cause on their own.
If compromise is suspected, bring in someone qualified to investigate and preserve the evidence. The NCSC specifically recommends checking for evidence of compromise and attacker backdoors in circumstances where systems couldn't be updated or disabled promptly. [2]
I wouldn't assume that applying a patch also answers every question about what happened before it was installed.
Get confirmation, then check the experience
If you're worried about your website, start by asking your host or developer for written confirmation of its PHP patch status and any follow-up work required. Then check that visitors can still reach your pages, contact you and complete the actions your marketing depends on.
If you'd like help reviewing that customer journey, book a consultation with me. We can work through your landing pages, forms and tracking, and coordinate with your technical provider on anything that needs attention.
Sources checked October 23, 2026