Business owners, nonprofits, schools, and anyone with a WordPress website: contact your hosting provider.

PHP, the software behind many websites, has two critical security vulnerabilities that could allow attackers to run malicious code on affected servers without logging in.

Fixes were released October 21. The patched versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. PHP says updating is the only complete fix.

Ask your host: “Has my website’s PHP installation been patched for CVE-2026-109618 and CVE-2026-109619?”

Updating your WordPress plugins alone does not confirm that your server’s PHP is patched.

Your website holds more than your brand colors. It may hold customer information, transactions, and community trust. Check the version. Confirm the update. Keep the receipts.

If you need IT support, please contact me (bianca@thelevel8agency.com) 🧾