Short version: on 21 October 2026, PHP published emergency fixes for two critical vulnerabilities. We have already applied them. We have no evidence of a breach, and no evidence that customer data was accessed. You do not need to do anything.
PHP is the software behind millions of websites, including WordPress. When a serious issue is found in it, we patch first and then tell you, in plain language, what it means for your site.
What are the vulnerabilities?
Both issues are in PHP itself. They are not a problem with your pages, your photos, or a WordPress plugin you installed. The PHP team rated both of them Critical, with a severity score of 9.2 out of 10, and asked every host to update immediately.
- CVE-2026-109618, memory corruption. A flaw in how PHP handles a particular kind of memory error. On a server that has not been updated, someone could potentially use it to run code they are not supposed to run.
- CVE-2026-109619, improper memory management. A flaw in how PHP keeps track of information between one visit and the next. On a server that has not been updated, someone could potentially use it to run unauthorised code or interfere with an application.
Left unpatched, issues like these can disrupt a website or put the information on that server at risk. That is the reason they were treated as urgent. The full technical notes are in the official PHP security archive.
Your data
We have no evidence of a breach, and no evidence that customer data was accessed, changed or taken.
After applying the update, we checked our platform. We have found no sign of unauthorised access connected to these vulnerabilities. That includes customer websites, email, and the account and billing details held in our client portal.
This update was a precaution, made as soon as the fix was published. It was not a response to an incident, and we are not aware of any customer information being compromised.
What HSJ Host has done
As soon as the security release was available, we applied it across our servers and the websites we host, including the HSJ Host client portal. PHP on our platform is now on the patched release.
The fix sits at the server level, which is where PHP runs. You do not need to edit your website, reinstall WordPress, or apply this update yourself. Looking after patches like this is part of how we keep hosting secure, stable and reliable.
Do you need to take any action?
No immediate action is required. The server-level patches are already in place.
If your website does something unexpected, or you would just like a second pair of eyes, open a support ticket and we will look into it with you. We can also tell you whether any separate website update, unrelated to this PHP patch, is worth doing.
You can also sign in any time at portal.hsj.host.
Thank you for trusting HSJ Host with your website. If you have a question, we are happy to help.
