Most business owners shouldn’t have to start their morning worrying about whether their website is exposed to a critical security issue. That’s what having a good website partner is for.
On 21 October 2026, urgent security updates were released to address two critical vulnerabilities in PHP, software that powers WordPress and a significant number of websites around the world.
The vulnerabilities could potentially allow attackers to run unauthorised code on affected web servers. In practical terms, that could put websites and the information they handle at risk.
Security researchers have identified the vulnerabilities as PHP2Shell, and website hosting providers around the world have been responding.
It sounds alarming, and it’s certainly something that deserves immediate attention.
But there’s an important distinction: a security vulnerability being discovered doesn’t mean your website has been hacked. It means a weakness has been identified and security updates are available to address it.
For MyWork customers, this is also a good example of why having the right people looking after your website matters.
What Happened With PHP on 21 October 2026?
PHP is one of the technologies that works behind the scenes to make websites function.
If your business uses WordPress, PHP helps run the website, process forms, display content and handle many of the functions your customers rely on.
Most business owners will never need to interact with PHP directly. It’s simply part of the technology that makes their website work.
On 21 October, the PHP development team released emergency updates to fix two critical security vulnerabilities.
These vulnerabilities could potentially allow an attacker to execute unauthorised code on an affected server without needing to log in.
That’s why the issue has attracted attention from security researchers, hosting companies and government cyber security agencies.
The official PHP website has published details of the security release, while WordPress has also issued guidance encouraging website owners to ensure their hosting environments receive the appropriate updates.
Why Does This Matter to Your Business?
Your website is often doing considerably more than displaying information about your business.
It might be:
- Receiving customer enquiries through contact forms
- Taking bookings or appointments
- Processing online orders and payments
- Connecting to your CRM or other business systems
- Helping potential customers decide whether to trust your business
All of that depends on the technology running behind the website.
And while your website might look perfectly normal to visitors, the software supporting it can still require urgent security attention.
That’s the challenge with website security. Problems aren’t always visible until something goes wrong.
Why Updating WordPress Isn’t Enough
One important thing about this particular security issue is that it doesn’t originate from WordPress itself.
The vulnerabilities affect PHP, which operates at the server and hosting level.
That means updating WordPress, installing the latest plugin versions or changing your website password won’t resolve these particular vulnerabilities.
The appropriate security update needs to be applied to the PHP environment running your website.
For most businesses, that responsibility sits with their website hosting provider or the technical team managing their server.
This is also where responsibilities can become unclear when different companies manage your website, hosting, domain and ongoing maintenance.
If something important needs updating, who is actually responsible for doing it?
What Has MyWork Done About the PHP Security Update?
For websites hosted with MyWork through WP Engine, our hosting partner has rolled out the relevant security updates.
Our technical team has also applied the necessary updates to the AWS servers we manage.
We’re checking that websites continue to operate as expected following those changes.
Behind the scenes, our responsibility includes keeping across important security announcements, understanding which systems may be affected and coordinating the appropriate response.
Sometimes that means working with a specialist hosting partner such as WP Engine. Other times, it means our own technical team making changes directly to the servers we manage.
Either way, the objective is the same: deal with important technical issues promptly, without leaving customers to work out what needs doing or who to contact.
For clients whose website hosting and ongoing support are managed through MyWork, that’s a significant part of the value of having everything looked after together.
The Value of a Good Website Partner Is Often in the Work You Never See
When businesses think about their website provider, they often think about the design, functionality or the occasional change they need made.
But a good website partner should be doing more than building a website and handing over the keys.
They should understand the technology behind it, keep across important changes and know what to do when something needs attention.
This week’s PHP security announcement is a good example.
Most business owners have more important things to do than investigate PHP versions, security vulnerabilities and server configurations.
They need to know their website is being looked after by people who understand those things.
One Team, Clear Responsibility
Having your website development, hosting and ongoing support managed together also helps avoid an issue we regularly see when taking over websites from other providers.
The website developer assumes the hosting company is responsible for something. The hosting company assumes it’s the developer’s responsibility.
Meanwhile, the business owner is left trying to work out who should fix the problem.
That’s not how website support should work.
At MyWork, we believe businesses are better served when there’s clear responsibility for their website and a team that understands how the different pieces fit together.
That doesn’t mean any provider can promise a website will never experience a security issue.
It means having people who can identify problems, respond promptly and explain what’s happening without expecting the business owner to become a technical expert.
What if MyWork Manages Your Website but Someone Else Hosts It?
Some MyWork customers use our team for website development, maintenance or support but have their website hosted through another provider.
In those situations, the company controlling the hosting environment is generally responsible for applying the PHP security update.
MyWork can manage the website itself, but we can’t necessarily make changes to servers controlled by another hosting company.
We’re contacting relevant clients directly to make sure they’re aware of the issue and can confirm their hosting provider is taking the appropriate action.
If your website is hosted externally, we’d recommend asking your provider to confirm:
- Whether the website’s PHP environment was affected by the October 2026 vulnerabilities
- Whether the relevant security updates have been applied
- Whether any further action or monitoring is required
If your hosting provider hasn’t yet applied the update, ask when it will be completed and what protective measures are in place in the meantime.
For older PHP versions, the situation can be more complicated because some versions are no longer supported by the PHP development team. Your hosting provider should be able to explain whether an appropriate vendor-supported security fix is available or whether an upgrade is required.
Wouldn’t It Be Easier if One Team Looked After Everything?
For many businesses, the answer is yes.
Website hosting isn’t just about keeping a website online. It’s also about having the right environment, ongoing maintenance, technical support and people who understand how the website operates.
When MyWork manages your website and hosting together, we have a clearer picture of the technology involved and who is responsible when something needs attention.
That can mean fewer support conversations, less back and forth between providers and a more coordinated response when something important happens.
It’s one of the reasons we offer MyWork COMPLETE, bringing ongoing website support and maintenance together with our broader website services.
The goal is simple. You concentrate on running your business, and we look after the website technology.
Frequently Asked Questions About the October 2026 PHP Security Update
What happened with PHP security on 21 October 2026?
On 21 October 2026, the PHP development team released emergency updates for two critical security vulnerabilities known as PHP2Shell. These weaknesses could potentially allow attackers to run unauthorised code on affected web servers. MyWork has been coordinating the relevant updates across the hosting environments we manage and checking that websites continue operating as expected.
Does the October 2026 PHP vulnerability mean my website has been hacked?
No. The discovery of a vulnerability does not automatically mean a website has been compromised. It means a security weakness has been identified that attackers could potentially exploit. A site-specific investigation would be needed to determine whether a website was accessed. MyWork recommends applying the appropriate security updates promptly and investigating any signs of suspicious activity.
Are WordPress websites affected by the October 2026 PHP security vulnerabilities?
WordPress websites use PHP, so their hosting environments may be affected by the October 2026 vulnerabilities. The issue is not specific to WordPress itself. MyWork recommends confirming that the PHP environment running the website has received the appropriate security fixes, rather than relying only on WordPress or plugin updates.
Is updating WordPress enough to fix the PHP security vulnerabilities?
No. The October 2026 vulnerabilities affect PHP at the hosting and server level. Updating WordPress, plugins or themes does not replace the required PHP security update. The hosting provider or server administrator needs to apply the appropriate fix. For websites hosted and managed through MyWork, our team coordinates these responsibilities with the relevant hosting platform.
Do MyWork hosting customers need to do anything about the PHP security update?
There is no action customers need to take themselves for this PHP update where MyWork manages the relevant hosting environment. Our hosting partner WP Engine has rolled out the relevant updates, and MyWork’s technical team has applied updates to the AWS servers we manage. We are checking that websites continue operating as expected and will contact customers if we identify anything specific that requires attention.
What should I do if my website is hosted by another company?
Contact your hosting provider and ask whether the October 2026 PHP security fixes have been applied to the environment running your website. If they haven’t, ask when the update will be completed and what protective measures are in place. MyWork can help customers understand which provider is responsible for their hosting and what questions they should ask.
Can a website appear normal even if its PHP software has a security vulnerability?
Yes. A website can appear to be functioning normally while the software behind it has a security weakness. That’s why security updates shouldn’t depend on whether a customer has noticed something wrong. MyWork works with its hosting providers and technical team to address important updates even when there is no visible problem with the website.
Why is it better to have website hosting and support managed by the same provider?
Having website hosting and ongoing support managed together helps establish clear responsibility when security updates, technical problems or maintenance work are required. It can reduce delays and confusion between different providers. MyWork offers website hosting and ongoing support so businesses have one team to contact when their website needs attention.
Not Sure Who Is Looking After Your Website Security?
If your website is hosted with MyWork, the relevant hosting updates have been addressed through our hosting partner or our managed server environments, and we’re continuing to check that everything operates as expected.
If your website is hosted elsewhere, we’d encourage you to confirm that your provider has applied the October 2026 PHP security fixes.
And if you’re tired of having to work out who is responsible every time an important website issue comes up, perhaps it’s time to bring everything together.
Contact MyWork to discuss your website hosting and support, or learn more about MyWork COMPLETE.
Your website should be working for your business, not giving you another technical problem to manage.