On the 21st of October 2026 it was announced that vulnerabilities discovered in PHP, a component of many website servers across the world, required immediate patching in order to protect sites – here’s what you need to know as one of our clients.
Managed clients
If you are a subscriber to our website management service then don’t worry, the necessary patches were applied across all our servers last night, as soon as they became available, ensuring your site was fully protected.
No action is needed on your part and your site is already protected.
Non-managed clients
If you are not a subscriber to our website management service and instead host your site privately then you will need to check with your host to ensure that they have applied all necessary patches.
We are aware that Siteground, one of the hosts our non-managed clients commonly use, already had fixes in place to mitigate these vulnerabilities and you can find out more on their public information post at https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026.
If your site is hosted elsewhere then please get in touch with your hosts as soon as possible to confirm they have applied the necessary patches to keep your site safe.
If you are not currently subscribed to our management service then feel free to get in touch with us to learn more about it.
Further information
For anyone interested, you can learn more about the vulnerabilities and what it all means at https://www.wordfence.com/blog/2026/10/critical-php-update-wordpress-vulnerabilities-testing/.
