PHP security alert
Two critical security flaws in PHP have hosting companies worldwide rolling out urgent fixes. Some organisations have taken their websites offline as a precaution.
We’re working with our hosting providers and updating as fixes become available.
If you’ve seen the headlines, here’s what’s happening and what it means for your business website.
What happened
PHP is software that runs WordPress and many other websites. The two vulnerabilities could allow an attacker to run malicious code on a vulnerable server without logging in.
The PHP team has released security fixes. Hosting providers now need to apply the appropriate updates across their servers.
This affects the software running underneath a website, so updating WordPress and plugins alone won’t apply this particular fix.
What we’re doing
At Left Bank Design, we follow updates from our hosting providers and apply them as they become available.
Different hosts run different server configurations and PHP versions, so the rollout varies between providers.
Some have introduced temporary protections while they deploy the fixes. These may restrict larger file uploads, backup restores, migrations or larger form submissions.
If you’ve had trouble uploading a file or completing an administrative task, those precautions may explain it. The impact depends on your hosting provider and the functions your website uses.
Does this mean your website has been hacked?
No. A security vulnerability means there is a weakness that attackers could exploit. It does not mean every website using the affected software has been compromised.
A website can still appear to work normally even if it needs a security update. Checking that it loads won’t tell you whether the fix has been applied.
What should you do?
If you manage your own website, ask your hosting provider:
“Have the fixes for PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 been applied to the PHP version my website uses?”
Your host can confirm whether the update is complete, still being deployed or requires a change to your hosting environment.
If Left Bank Design looks after your website and you have a question about its status, get in touch through our website.
Published 22 October 2026. Hosting updates are still rolling out, so individual provider status may change.
Sources: PHP security announcements · Australian Cyber Security Centre advisory
