Yesterday, two critical security flaws were disclosed in PHP, the technology behind a huge share of the world’s websites. Both carried a severity score of 9.2 out of 10. In plain terms, attackers could take control of an affected website without needing a username or password.
For website owners everywhere, it was a race against time.
For Hot Dog Solutions clients, the race was already over. We checked and patched every website we look after on the day the flaws went public. Our clients didn’t have to lift a finger.
This post explains what happened in plain English, what it meant for businesses, and how proactive maintenance stopped a serious threat from becoming a serious problem.
What is PHP, and why does it matter to your business?
PHP is a programming language that runs on the server, behind the scenes of your website. You never see it, but it does a lot of the heavy lifting.
When a customer loads a product page, adds something to their basket or logs into their account, PHP is often the engine making it happen. It pulls information from your database, builds the page and sends it to the shopper’s screen.
The foundation of millions of websites
Some of the world’s most popular website platforms run on PHP, including:
- WordPress, which powers a vast number of business websites and blogs
- WooCommerce, the ecommerce plugin that turns WordPress into an online store
- Magento (Adobe Commerce), used by many mid-size and enterprise retailers
- Drupal and a long list of other content management systems
Think of PHP as the foundations of a building. Most days, nobody thinks about them. But if a crack appears, everything above it is at risk.
That’s why this disclosure sent security teams around the world scrambling. When the foundations have a flaw, it affects a lot of buildings at once.
What actually happened?
On 21 October 2026, the team behind PHP published two security advisories. Each one described a separate flaw in the core of the language itself, not in a single plugin or theme.
The vulnerabilities were officially logged as CVE-2026-109618 and CVE-2026-109619. Both were rated critical, with a severity score of 9.2.
Flaw 1: When memory runs out, things get messy
Every time someone visits a PHP website, the server sets aside a little memory to handle that visit. The first flaw related to what happens when that memory runs out mid-task.
Picture a chef halfway through prepping a dish when the kitchen suddenly closes. The ingredients are left half-chopped on the counter. Then the cleaning crew arrives and treats the mess as if it were a finished meal.
That’s roughly what happened inside PHP. An attacker could deliberately send a carefully crafted request that caused PHP to run out of memory at just the wrong moment. PHP then tried to tidy up using information that was only half-ready. With the right technique, that confusion could be turned into a way to run the attacker’s own code on the server.
Flaw 2: Leftovers from the last visitor
The second flaw was about information hanging around longer than it should.
A web server handles visitors one after another. Between each visit, PHP is supposed to wipe the slate clean. This flaw meant that, in certain situations, scraps of information from one visit weren’t properly cleared before the next one began.
Imagine a hotel room where the previous guest’s key still works after they’ve checked out. An attacker could set things up during one visit, then come back and exploit those leftovers on the next.
What “unauthenticated remote code execution” really means
You may see this phrase in security reports. It sounds technical, but it breaks down simply:
- Unauthenticated: The attacker doesn’t need to log in. No username, no password.
- Remote: They can do it from anywhere in the world, over the internet.
- Code execution: They can make your server run their instructions.
Put together, that’s about as serious as website security gets. An attacker who can run code on your server could potentially steal customer data, alter your site, plant malicious software or take it offline entirely.
By now, you should understand why these flaws made headlines, and why speed mattered so much.
Which websites were affected?
The flaws affected a very wide range of PHP versions. Every supported version line needed an update, including the one our clients’ websites were running.
Our client sites were on PHP 8.3.35. The PHP team released PHP 8.3.36 to fix both vulnerabilities. Patched versions were also released for other supported lines:
- PHP 8.2.35
- PHP 8.3.36
- PHP 8.4.27
- PHP 8.5.12
A warning for older websites
Here’s the part that worries us most for businesses outside our care. PHP 8.1 and earlier versions will not receive a fix. They’ve reached “end of life”, which means the PHP team no longer supports them.
If your website runs on an older version of PHP, it remains exposed. The only way to fix it is to upgrade to a supported version. That’s not always a quick job, especially for older sites with custom code or outdated plugins.
How Hot Dog Solutions responded
Yesterday was a busy day in the Hot Dog Solutions office!
The moment the vulnerabilities were disclosed, our team swung into action. Here’s what we did:
- Assessed the risk. We reviewed both advisories to understand exactly which versions were affected and how serious the threat was.
- Checked every client website. We confirmed which PHP version each site was running. All were on PHP 8.3.35, so all needed updating.
- Applied the patch. We updated every site we look after to PHP 8.3.36, closing both security holes.
- Confirmed everything was running smoothly. We made sure sites were working as normal after the update, with no disruption to customers.
- Kept clients informed. We let clients know what had happened and confirmed their websites were already protected.
All of this happened on the day of disclosure, as part of our ongoing maintenance and support service.
No action needed from our clients
This is the bit we’re proudest of. Our clients didn’t need to read a single technical advisory. They didn’t need to call their developer, book an emergency fix or worry about whether their website was safe.
By the time most of them heard about the problem, we had already solved it.
Why proactive patching matters
When a critical flaw goes public, the clock starts ticking. The details become available to everyone, including the people looking to exploit them. Attackers often start scanning the internet for unpatched websites within hours.
The businesses most at risk are the ones waiting for someone to notice.
Out-of-hours support that doesn’t clock off
Security threats don’t keep office hours. A vulnerability can be announced late in the evening, at the weekend or in the middle of your busiest trading period.
That’s why our maintenance and support service includes out-of-hours monitoring and response. When something serious happens, we don’t wait until Monday morning. We act.
With Black Friday just weeks away, timing like this matters more than ever. The last thing any ecommerce business needs is a compromised website during peak season. Lost sales, damaged trust and potential data breaches can cost far more than any maintenance plan.
The real cost of doing nothing
It’s tempting to see website maintenance as a “nice to have”. Until something goes wrong, it can feel like money spent on nothing.
But consider what an attack could cost you:
- Revenue lost while your site is offline
- Customer data exposed, with the regulatory headaches that follow
- Your reputation damaged in front of the very customers you’ve worked hard to win
- Emergency developer fees to clean up the mess
Proactive maintenance costs a fraction of that. It’s the difference between fixing a crack in the foundations and rebuilding the house.
Not sure if your website is protected?
If you don’t work with us yet, here’s what we’d recommend checking right now:
- Find out which PHP version your site runs. Your developer or hosting provider can tell you.
- Make sure it’s been updated. You should be on PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or newer.
- If you’re on PHP 8.1 or older, act fast. There’s no patch coming, so you’ll need a proper upgrade.
- Ask who’s watching out for you. If nobody contacted you about this, that tells you something.
If you can’t get a clear answer, that’s a red flag. And it’s exactly the kind of situation we help with.
We only win when you do
At Hot Dog Solutions, we work as an extension of your team. That means keeping an eye on the things you shouldn’t have to worry about, so you can focus on growing your business.
Yesterday proved why that matters. A critical, internet-wide threat appeared, and our clients carried on trading as normal. No panic, no downtime, no nasty surprises.
That’s what proactive support looks like. And because we only win when you do, protecting your website is protecting our shared success.
Want to know your website is in safe hands? Talk to our team today at hotdogsolutions.com.
Hot Dog Solutions. Don’t let your visitors go Walkies.
