Critical PHP Vulnerabilities: How We Responded Across 40 Client Websites

When a critical security vulnerability emerges, your business needs someone who can understand the risk and respond.

Following the disclosure of CVE-2026-109618 and CVE-2026-109619, we patched 40 client websites as part of our response within 12 hours.

For our clients, this is a practical example of what ongoing website care means: having a developer who takes responsibility for the technology behind your business, beyond the initial launch.

What Happened?

On 21 October 2026, the PHP project released security updates addressing two critical vulnerabilities. Under certain conditions, these flaws could allow an unauthenticated attacker to execute code on a server running PHP.

PHP powers the server-side functionality of many websites and applications. A vulnerability in PHP itself therefore requires attention beyond updating a website’s content, design or plugins.

The issues involved memory handling within PHP’s core. Google’s technical explanation describes failures involving incomplete request data and internal state remaining after its underlying memory had been freed.

For business owners, the implication is straightforward: the software running behind your website needs maintenance too.

Our Response: Patching 40 Client Websites

We responded by patching 40 client websites to address these vulnerabilities.

This work sits behind the scenes. It does not introduce a new homepage, change your branding or add a feature customers can see. Its purpose is to address a serious security risk in the infrastructure supporting your website.

Clients should not have to interpret every security advisory themselves. Having an ongoing developer relationship gives them a point of contact who understands their website and can respond when action is needed.

That responsibility becomes especially valuable when a vulnerability affects a foundational technology rather than an individual website component.

Why Plugin Updates Alone Are Not Enough

Website maintenance involves several layers: the application, its extensions, the server environment and the underlying runtime.

These vulnerabilities affected PHP itself. Updating WordPress or a plugin alone should not be treated as confirmation that the PHP runtime has been patched.

The PHP team explicitly urged users to update, stating that there were no complete mitigations and that updating was the safe choice.

This is why maintenance needs to consider the complete environment supporting a website.

Good Website Development Continues After Launch

A website is an ongoing business asset. Customers may rely on it to make enquiries, book services or place orders. Maintaining that asset requires attention as technology changes and new vulnerabilities emerge.

Our response across 40 websites reflects the value we aim to provide: clear ownership, technical understanding and action when it matters.

Patching these vulnerabilities addresses a specific risk; it does not make any website permanently immune to future threats. Security requires continued care.

Your Website Deserves Ongoing Care

Choosing a developer is also choosing who you can turn to after launch.

At Calvin Seng, we take that relationship seriously. Beyond building websites, we help clients maintain the technology their businesses depend on.

Need support for your existing website? Contact Calvin Seng to discuss website development, maintenance and ongoing technical care.