Websites on Des Moines Creative’s managed hosting have the security patches addressing the two critical PHP vulnerabilities disclosed on October 21, 2026. Managed hosting clients do not need to install these server patches themselves.
This is one reason we pair managed hosting with daily backups and routine website updates. Your business needs someone responsible for the software behind the website, including the parts you never see in WordPress.
What is the PHP security issue
PHP is part of the software that runs WordPress on your hosting server. It works behind the scenes to process requests and generate website pages.
The October 21 security release addresses two flaws, CVE-2026-109618 and CVE-2026-109619. They involve how PHP manages memory and internal request data. Successful exploitation could let an attacker run code on an affected server without first logging in. [1]
That makes this a hosting-level issue. Updating a WordPress plugin or changing your administrator password does not install the PHP fix. Your hosting provider or server administrator needs to apply it.
PHP released fixes in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Some hosting providers and operating-system vendors apply equivalent fixes to their own packages. Ask whether both vulnerabilities are patched, rather than relying on a version label alone. [1]
How DMC helps protect your website
For clients on our managed hosting and maintenance plan, website care continues after launch. Our service includes daily backups, routine WordPress core, plugin and theme updates, security monitoring, and uptime and performance oversight. We test routine monthly updates to help catch conflicts and site failures. [6]
Those responsibilities cover different layers of your website. WordPress updates maintain the application. Hosting providers handle the underlying server software. Daily backups provide recent recovery points when something goes wrong.
The PHP security patches address these two vulnerabilities for websites on DMC’s managed hosting. Routine maintenance and backups support the broader, ongoing work of protecting your website.
Urgent security fixes need attention when they become available. A normal monthly maintenance schedule should never become a reason to postpone a critical patch.
Why stopping updates increases your risk
A website does not need new pages to need maintenance. The software underneath it continues to change, and researchers continue to find vulnerabilities.
When a business stops updating, known security gaps may stay open after fixes become available. Unsupported plugins and older server software add another problem: the original developer may no longer provide routine security fixes. WordPress specifically recommends keeping its core software, plugins and themes current and choosing products that still receive updates. [2]
PHP 8.1 and older no longer receive regular upstream updates. Some vendors provide extended support or backported patches, and PHP published limited source backports for this emergency. An older installation still needs a verified fix and a plan to move onto supported software. [1]
Even a regularly maintained website needed attention during this release. The higher risk comes from leaving an affected installation unpatched, especially when nobody is responsible for checking it. A homepage that loads normally tells you very little about that risk.
What a compromised website could mean for your data
Researchers at Wiz demonstrated both remote code execution and exposure of sensitive PHP process memory. Their findings show that exposed memory may contain passwords, authentication tokens or API keys. These keys and tokens help software connect to other services. [3]
For a business, the possible consequences depend on what the site stores and what the compromised software has permission to access. Risks include:
- Exposure of customer inquiries, contact details, account information or order records stored in the website database.
- Theft of connection credentials that could put linked services at risk.
- Changes to website content, malicious redirects or disruption of forms and other business functions.
These are possible consequences of compromise, not proof that a particular website lost data. Using an external CRM or payment provider changes where information lives, but it does not automatically remove every website-related risk. The site’s integrations, stored credentials and access permissions still matter.
Daily backups help you recover
DMC’s daily backups give managed clients recent versions of their websites to restore. A complete WordPress recovery needs both website files and the database, which is why WordPress’s own guidance addresses both. [4, 6]
Backups serve a different purpose from security updates. A backup will not close an unpatched vulnerability or retrieve data an attacker already copied. Restoring a compromised site also requires addressing the entry point and checking for remaining unauthorized access. Changes made after the last backup may need to be recovered separately.
WordPress needs someone responsible for maintenance
Our recommendation is straightforward: if your business runs WordPress, have a dedicated developer on staff with responsibility for maintenance, or invest in a managed maintenance plan.
Assign that person or provider clear responsibility for updates, hosting coordination, backups and recovery. They should know who handles PHP patches, verify that critical fixes reach the live environment, and check that forms and other important functions still work afterward.
For this PHP issue, CERT-EU recommends immediate patching. When that is not feasible, its guidance says organizations should consider isolating affected internet-facing applications until the fix is applied and verified. This is not an update to leave in the queue indefinitely. [5]
If your company stopped maintenance, start by confirming your PHP patch status and the last successful backup. Then review WordPress, plugins, themes and access permissions with a qualified developer.
Des Moines Creative provides managed WordPress hosting and maintenance for businesses that need ongoing technical care. We handle daily backups and routine updates so website upkeep has a clear owner.
Explore our managed hosting and maintenance services or contact Des Moines Creative to discuss your website.
Sources
- PHP: Security advisory and patched releases, October 21, 2026
- WordPress: Security guidance
- Wiz Research: PHP2Shell research and demonstrated data exposure
- WordPress: Backups guidance
- CERT-EU: Critical Vulnerabilities in PHP, advisory 2026-018
- Des Moines Creative: Managed Hosting Services
