A major security vulnerability affecting PHP, one of the world's most widely used web technologies, has prompted urgent action from website owners, hosting providers and software developers around the world.
On 21 October 2026, the UK's National Cyber Security Centre (NCSC) issued an official alert urging organisations to take immediate steps to protect their systems.
At Bollabo, we began implementing protective measures before the official security update became available, followed by a coordinated programme of updates and security checks across our hosting infrastructure, client websites and custom-built software applications.
What happened?
On 20 October, details emerged of two critical security vulnerabilities affecting PHP, the programming language behind millions of websites and applications, including WordPress.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, involved weaknesses in how PHP handles memory and processes requests.
Under certain conditions, these weaknesses could allow an attacker to execute malicious commands on an affected server remotely, without requiring a username or password.
What made the situation particularly serious was that the issue affected PHP itself, rather than an individual website or plugin. This meant that even professionally developed and regularly maintained websites could potentially be exposed.
The PHP development team released security fixes on 21 October, with the NCSC advising organisations to apply the updates urgently.
Read the official NCSC security alert
How Bollabo responded
Protecting our clients' websites, applications and business information is a fundamental part of our managed hosting and software services.
As soon as the potential threat became known, we began reviewing our infrastructure and implementing appropriate protective measures.
Our response included:
- Immediate protective measures: Implementing temporary security protections before the official PHP update became available to help reduce exposure to potential attacks.
- PHP security updates: Applying the official security fixes and checking our websites and applications to confirm they were running updated versions.
- Legacy software removal: Removing an unused, unsupported version of PHP from our infrastructure. All affected client websites had already been migrated to supported versions.
- Hosting infrastructure updates: Updating our WHM hosting server and Amazon Web Services (AWS) instances, including relevant system software and PHP components.
- WordPress security reviews: Reviewing installed plugins and removing outdated or unsupported components that could introduce additional security risks.
- Security credential updates: Refreshing selected passwords and security keys as a precaution.
In some circumstances, essential security maintenance can require websites or applications to be temporarily unavailable. Our priority throughout has been to complete the necessary work safely while minimising disruption to our clients.
Why proactive monitoring makes a difference
One of the biggest challenges during a widespread security incident is understanding exactly which systems may be affected.
For businesses managing multiple websites, servers and software applications, identifying vulnerable systems and tracking security updates can be a significant undertaking.
This is where our own monitoring technology, Bollabo Guardian, plays an important role.
Guardian is an in-house monitoring system developed to give us greater visibility over the health, security and performance of the websites and software applications we manage.
Installed as a lightweight plugin on WordPress websites or as a monitoring script within our custom-built applications, Guardian regularly reports information to our central monitoring dashboard.
It helps our team:
- Identify security vulnerabilities by checking PHP, WordPress, plugins and software dependencies against published security advisories.
- Monitor website availability and alert us when a website or application becomes unavailable.
- Track outstanding software updates so that potentially vulnerable components can be addressed.
- Detect application errors that could indicate problems with website functionality.
- Monitor contact forms and online orders for unexpected changes in activity that could indicate something has stopped working.
- Monitor scheduled website tasks to help ensure essential background processes continue operating as expected.
Guardian operates as a monitoring and reporting system. It does not automatically make changes to client websites, and it does not transmit website passwords or sensitive configuration settings.
During this incident, Guardian's centralised reporting helped us identify affected PHP installations, prioritise updates and track the work required across our managed systems.
Rather than relying entirely on manual checks, our team had a central overview of the systems requiring attention.
Website security is an ongoing responsibility
Incidents like this demonstrate an important point: even well-maintained websites and software applications can be affected by vulnerabilities discovered in widely used technologies.
A website doesn't need to be poorly developed or neglected to become exposed to a newly discovered security issue.
The difference often comes down to how quickly a vulnerability is identified, how effectively the risks are assessed and how promptly appropriate protective measures can be implemented.
At Bollabo, our approach combines regular software maintenance, security monitoring, managed hosting and direct technical oversight.
We're continuing to monitor developments relating to these PHP vulnerabilities, carry out malware and security scans, review software dependencies and apply further updates where necessary.
What does this mean for our clients?
Clients whose websites and software applications are managed by Bollabo do not need to take any action in response to this incident at this stage.
We have been proactively reviewing and updating the systems we manage and will continue monitoring for further security developments.
If any additional action is required, we will contact affected clients directly.
For businesses concerned about their own website security, this incident is a useful reminder of the importance of supported software, regular security updates, proactive monitoring and reliable technical support.
Your website is an important part of your business. Keeping it secure shouldn't be an afterthought.
If you have any questions about your website, hosting or software security, please contact Bollabo.
Further information: National Cyber Security Centre – Critical Security Issue Affecting PHP