A website can look and work normally while the software behind it needs a security update. If you have a WordPress website, the latest PHP security advisory is a reason to ask your hosting provider to confirm what has been checked.
On 22 October 2026, the National Cyber Security Centre warned about two critical PHP vulnerabilities and said it was aware of reports of active exploitation. PHP is part of the software used to run WordPress and many other websites. NCSC PHP advisory WordPress hosting requirements
We have already patched our servers in coordination with our hosting provider.
What the alert means for a business owner
The issues concern the software processing web requests on the server. Updating a page or installing the latest version of a WordPress plugin does not establish that the hosting software has been patched.
The PHP project released security fixes on 21 October. It also noted that operating system and long-term support vendors may supply their own patched packages. Your host needs to confirm the position for the software actually serving your website. A version number alone may not tell the whole story. PHP official announcements
Ask for confirmation
A useful question for your provider is: “Has the PHP environment serving our website been checked against the October security advisories, and have the required fixes been applied?”
If your website developer and hosting provider are different businesses, ask who is coordinating the check. You should not have to work out which server setting needs changing yourself.
Ask whether anything remains outstanding and whether there are signs that need further investigation. The NCSC advises affected organisations to investigate possible unauthorised access as well as applying remediation. NCSC PHP advisory
Keep the advice current
PHP published further configuration guidance on 23 October and updated Windows packages on 26 October for a separate dependency issue. Those details depend on the environment in use, so the person managing the server should check the current vendor guidance. PHP official announcements
Avoid changing unfamiliar hosting settings just to clear a warning. Arrange the appropriate fix with your provider and check important website functions afterwards.
If we manage your website or hosting and you would like clarification about which parts are covered, get in touch. We can check the arrangements and explain what needs to happen next.
