When a vulnerability makes headlines
On 21 October 2026, two critical security vulnerabilities were disclosed in PHP, the programming language powering millions of websites, including those built using WordPress. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, received severity scores of 9.2 out of 10 and could allow attackers to execute malicious code on vulnerable servers without authentication. The UK's National Cyber Security Centre (NCSC) urged organisations to take immediate action, identify affected systems and apply the necessary security updates.
For businesses relying on PHP-powered websites, this wasn't simply another routine software update. It was a reminder that security risks can emerge even when a website appears to be working perfectly. At The Human Tech Agency, we responded by reviewing the PHP versions used by our hosting clients and updating their environments where necessary. Our clients hadn't raised support tickets. Their websites weren't necessarily showing signs of problems. But waiting for something to go wrong wasn't an approach we were comfortable with. So we acted.
The difference between hosting and maintaining a website
There's a common misconception that paying for website hosting means everything behind the website is automatically being maintained. In reality, hosting and website maintenance are two different responsibilities. Hosting provides the infrastructure needed to make a website available online. Ongoing maintenance involves monitoring software, applying security patches, managing dependencies and ensuring updates don't introduce unexpected problems.
For many businesses, that distinction isn't immediately obvious. And understandably so. If your website is working, why would you need to think about the version of PHP running behind it? The difficulty is that security vulnerabilities don't always announce themselves through broken functionality. A website can continue operating normally while running software with a known security issue. That's why preventative maintenance matters, and why having a clear website support and hosting arrangement can make a significant difference.
What we did for our clients
Following the PHP security announcements, our development team took proactive steps to review and update the PHP environments supporting our clients' websites. Although these clients have hosting arrangements with us rather than dedicated cybersecurity or ongoing maintenance agreements, we recognised the importance of responding promptly.
We carried out the necessary PHP version updates without additional charges for this particular intervention. It wasn't about delivering a new feature or making a visible improvement to a website. It was about reducing exposure to a known security risk and helping ensure the websites we host remained supported by up-to-date software. This is the kind of work that often goes unnoticed. And ideally, it should. When preventative maintenance is handled effectively, the end result is often that nothing visibly changes for the client or their customers.
Why updating PHP isn't always as simple as clicking a button
When a security update is released, the obvious response is to install it. But for an established website, software updates can have wider implications. A newer PHP version might behave differently from an older one. WordPress themes, plugins and custom functionality may rely on features that have changed or been deprecated. An update that resolves a security issue could introduce a compatibility problem if it isn't approached carefully. That's why responsible maintenance involves more than simply changing a version number.
It means understanding the website's dependencies, considering compatibility and checking that important functionality continues to work after an update. The official PHP documentation on migrating between versions highlights the importance of reviewing compatibility changes when upgrading. For businesses, this is where having an experienced technical partner makes a difference. It's not just about knowing that an update exists. It's about knowing how to apply it safely.
Security is an ongoing responsibility
No website platform is immune to security vulnerabilities. WordPress, Umbraco, custom applications and the technologies supporting them all require maintenance throughout their lifetimes. The risks differ depending on the architecture, dependencies and hosting environment, but the underlying principle remains the same. Software changes. New vulnerabilities are discovered. Security patches are released. A website that was secure when it launched won't necessarily remain secure without ongoing attention.
As we explored in our article, Umbraco vs WordPress: When a CMS's Greatest Strengths Become Its Weaknesses, the technology chosen to power a website can have significant implications for its long-term security, flexibility and maintenance requirements. The recent PHP vulnerabilities illustrate why these decisions matter. Importantly, the vulnerabilities existed within PHP itself, not WordPress. A fully updated WordPress installation could still be exposed if the underlying PHP runtime hadn't received the necessary security patches. The European Union Agency for Cybersecurity (ENISA) similarly advised organisations to identify PHP-based applications, coordinate with their hosting providers and prioritise security updates for internet-facing systems. Security isn't simply about choosing the right CMS. It's about understanding and maintaining the entire technology stack.
What should you expect from your website partner?
When a critical vulnerability is announced, businesses shouldn't need to become security experts overnight. They should, however, know who to contact and what support arrangements they have in place. A good website partner should be able to explain whether a vulnerability affects your technology, what action is needed and how that action will be managed. Just as importantly, there should be clarity about the difference between hosting, routine maintenance and emergency security support.
Our recent PHP updates were a proactive intervention for our hosting clients, rather than part of a dedicated cybersecurity service. We believe transparency about those responsibilities is important. Businesses need to understand what their existing arrangements cover and when additional support may be required. For organisations that want more structured protection, our website support, hosting and maintenance services offer options for ongoing monitoring, security patching, technical support and continuous improvement. Because responding to an emergency is important, but having a plan before one happens is even better.
Looking beyond the next security update
The recent PHP vulnerabilities are unlikely to be the last security issues affecting widely used web technologies. That's simply the reality of running software. The question isn't whether another vulnerability will eventually be discovered. It's whether your business has the right processes and support in place to respond when it happens.
At The Human Tech Agency, we believe looking after a website means thinking about its future, not just its launch. Sometimes that means delivering new features or improving performance. Other times, it means making an important update behind the scenes before a problem has the chance to develop. Not every improvement to a website is something you can see. Sometimes the most valuable work is the work that prevents something going wrong.
Is your website getting the support it needs?
If you're unsure who's responsible for maintaining your website, whether your software is up to date or what would happen if a critical vulnerability emerged, it's worth having that conversation before an incident occurs.
Get in touch with The Human Tech Agency to discuss your website's hosting, maintenance and long-term support requirements.