Critical PHP Security Vulnerabilities – How We've Protected Our Customers

Two critical security vulnerabilities have been disclosed in PHP, the technology that powers millions of websites worldwide, including WordPress.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been rated 9.2 out of 10 in severity.

If exploited, they could potentially allow attackers to remotely execute malicious code on vulnerable web servers without requiring login credentials. This could lead to compromised websites, stolen information and disruption to business operations.

Given the widespread use of PHP, this is a significant security event requiring urgent attention.

We've Already Taken Action to Protect Our Customers

At Addictive Technology Solutions, we immediately assessed the risk across our managed hosting environments and customer infrastructure.

Our managed website hosting infrastructure had server-level security protections implemented ahead of the public disclosure, providing protection for our hosted customers without requiring them to take individual action.

Our technical team has also been reviewing customer environments, applying emergency security updates where required and verifying that critical services remain operational.

We'll continue monitoring developments and ensuring permanent security patches are applied as required.

Why Managed Hosting Matters

This incident is a good example of why having a website professionally managed is important.

Security vulnerabilities don't always come from WordPress plugins or outdated website software. Sometimes the issue exists in the underlying infrastructure running the website.

When critical vulnerabilities emerge, businesses need confidence that someone is actively managing their hosting, applying security updates and responding before problems arise.

Our approach is simple: identify risks early, act quickly and minimise disruption to our customers.

What Should You Do?

If your website is hosted and managed by Addictive Technology Solutions, the relevant hosting-level protections have already been implemented, and we're managing the ongoing patching and verification process.

No immediate action is required from our managed hosting customers.

If your website is hosted elsewhere, we strongly recommend contacting your hosting provider to confirm that the relevant PHP security fixes and protections have been implemented.

Need Assistance?

If you're unsure whether your website or hosting environment is protected, our team can help assess your exposure and recommend the appropriate action. Schedule a 10-minute discovery call.