PHP vulnerability response
Critical PHP flaws.
Is your site ready?
In October 2026 two critical PHP flaws (CVE-2026-109618 / 109619) were disclosed, and many sites, including medical associations, went offline as a precaution. From a free exposure check to a full update done for you, we have a dedicated menu.
Check these three things first
- 1
Is PHP on the patched version?
Ask your hosting company or web agency, or check the server control panel.
- 2
Is the version number visible from outside?
Our free check shows whether PHP or CMS versions are exposed.
- 3
Is the admin page open to everyone?
Restrict access or turn on two-factor authentication.
How the Emergency Update service works
- 1
Apply
Use the form. We reply on weekdays during business hours.
- 2
Check
We check versions and exposure from outside, and agree the work with you.
- 3
Protect and update
We put temporary WAF protection in place, take a backup, and update PHP and the CMS.
- 4
Confirm
We check the site works and send a plain-language report.
Questions
We do not know whether our site uses PHP.
Start with the free check. Most WordPress sites run on PHP.
We are on a rental server. Can you still help?
Yes. Updates are done within what the hosting plan allows; if the server cannot be updated, we suggest options.
Does a WAF alone solve the problem?
No. A WAF reduces attacks while you prepare, but applying the patched version is essential.
We only check what anyone can see from outside, unless you give written consent for more. These measures reduce risk; they cannot remove it entirely.
See all 35 services →