On Tuesday, the PHP project shipped an emergency release. Not a routine monthly update, the kind you can schedule for a quiet afternoon, but an out-of-band patch for a flaw rated critical. If your business runs on WordPress, and most small and mid-sized business sites do, PHP is the engine underneath it. A critical hole in that engine is a critical hole in your website.

Here is what the vulnerability was, why "critical" is not a word the PHP team uses lightly, and how every site we host was patched the same day it was disclosed.

What Actually Happened

The flaw, tracked as CVE-2026-109618 and CVE-2026-109619, sits deep in PHP's core, in the part of the engine that manages its own internal state. It carries a CVSS severity score of 9.2 out of 10. In plain terms, it is the kind of memory-safety bug that can corrupt what PHP is doing mid-request, which at the severe end can mean crashes or, in the wrong hands, a path to running code on the server your site lives on.

The PHP team does not ship emergency releases for minor issues. An out-of-band patch means the maintainers decided this could not wait for the next scheduled version. When that happens, the clock starts: the details are public, and so the people looking to exploit it now have the same information the defenders do.

Why the Speed Matters

The uncomfortable truth about this class of vulnerability is that the fix exists on day one. The exposure is entirely about how long a site stays unpatched after that. Attackers scan the whole internet for machines still running the old version, because those are the easy targets. The window between "patch released" and "patch applied" is the window where you are exposed.

On a lot of hosting, that window is long. On cheap shared hosting, you are waiting for the provider to get to it on their own schedule. On a site someone set up and walked away from, nobody is watching at all, and it can sit unpatched for months. That is how sites get compromised: not by exotic attacks, but by known holes left open long after the fix was available.

How We Responded

We patched every WordPress and PHP site we host the same day the release landed. Not a sample, not the important ones first and the rest later. All of them, more than forty sites, brought current in a single coordinated pass.

A few things we think are worth spelling out, because they are the difference between "we ran an update" and "we did this responsibly":

  • We patched both layers. The fix went onto the PHP running inside each individual site and onto the server's own system PHP. A vulnerability at either level is a vulnerability, so both get closed.
  • We tested before we deployed. We do not blindly auto-update and hope. One older site was still on a PHP version that needed a larger jump to get current. Before making that move we verified its theme and plugins were compatible, so the security fix did not come at the cost of a broken site.
  • We kept a way back. Every change was made with a tested rollback ready, so if anything had misbehaved we could have reverted in seconds. Nothing did. Zero downtime, zero failures.
  • We confirmed our monitoring saw everything. After the pass we checked that every site, including newer ones, was accounted for in our monitoring, so we would know immediately if anything drifted.

This Is What Managed Hosting Is For

Most of the time, managed hosting looks like nothing is happening. The site is up, it is fast, and you are running your business. Weeks like this one are the reason it is worth paying for. A critical vulnerability was disclosed, and before most of the internet had even read the advisory, the sites we host were already patched, tested, and verified. Our clients did not have to know it happened, which is exactly the point.

If your website runs on hosting where nobody is watching the layer underneath it, this week is a good prompt to ask a simple question: when that advisory went out, who patched your site, and how long did it take? If the honest answer is "no one" or "I am not sure," that is the gap we close.

We design, build, and run websites for businesses across Northern Virginia and the DC metro on infrastructure we own and manage, with security updates, backups, and monitoring handled by the same team that built the site. One accountable team, so nothing falls through the cracks on the week it matters most.