PHP security update applied

You may have seen news today about two critical security flaws in PHP, the programming language that powers WordPress and most of the websites we host. The UK’s National Cyber Security Centre has asked organisations to apply the fix as a priority.

We applied the PHP security update to our hosting server this afternoon, Wednesday 21 October, shortly after the fix was released. Your website stayed online throughout and there is nothing you need to do.

What happened The flaws (CVE-2026-109618 and CVE-2026-109619) could allow an attacker to run commands on a web server without needing a login. A fixed version of PHP was published today, and some organisations that could not update quickly have taken their websites offline as a precaution.

What we have done We have updated PHP on our server to the fixed versions. We have also checked the server for signs of unauthorised access and found none. Our existing protections, including firewall rules, malware scanning and daily backups, remain in place.

What happens next We are monitoring the server closely and will apply any further updates from PHP or our hosting software providers as soon as they are released. We will update this notice if anything changes.

If you have any questions, please email support[@]fleek.marketing