Recent critical security vulnerabilities discovered in PHP, the programming language that powers WordPress, among other website CMS, have prompted an industry-wide security response. The vulnerabilities could allow unauthenticated attackers to execute malicious code on affected servers, making prompt patching a priority for website owners and hosting providers alike.

At Catalyst Visuals, we take website security seriously. We want to share what happened, how our hosting team responded, and what this means for protecting your website moving forward.

Understanding the Recent PHP Security Vulnerabilities

On October 21, 2026, the PHP development team released security updates addressing two critical vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Both were rated 9.2 out of 10 under the CVSS v4.0 severity scoring system.

These vulnerabilities affect PHP itself, rather than WordPress alone. Under certain conditions, they could allow an attacker to execute code remotely on a vulnerable server without authenticating first. Because PHP powers a substantial portion of the web, the potential impact extends beyond WordPress to other PHP-based websites and applications.

The PHP team released patched versions, including PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. We have been working to deploy the appropriate fixes and implement additional protections.

For website owners, this situation highlights an important point: website security depends on more than keeping WordPress, themes, and plugins updated. The underlying server environment and programming language must also be maintained and secured.

For additional technical details, visit the official PHP security advisory.

How Your Hosting Partner Responded

As a managed WordPress hosting provider, our web hosting team plays an important role in maintaining the security of the infrastructure supporting our websites. Its response to this incident progressed from active monitoring and mitigation to deploying patches across its platform.

October 21: Active Monitoring and Protective Measures

When the vulnerabilities were identified, our hosting security team began actively monitoring the situation and implementing mitigation measures.

In its initial PHP Security Update, our hosting partner, WP Engine reported that it had already deployed protective measures at the content delivery network (CDN) layer through Cloudflare and Fastly. These protections provided an additional layer of defense while the official PHP patches became available and deployment work progressed.

This initial response was an important step in reducing exposure while the underlying vulnerabilities were being addressed.

October 22: Security Patches Deployed

We have since confirmed that we have patched the two critical PHP vulnerabilities across its platform.

Its latest customer-facing update states that the vulnerabilities have been patched on the our hosting platform and no action is needed from customers.

The update identifies the following PHP versions:

• PHP 7.4.33.17
• PHP 8.2.35
• PHP 8.4.27
• PHP 8.5.12

Our approach combined early protective measures with the deployment of patches to address the underlying vulnerabilities. This is the kind of coordinated response that matters when a security issue affects foundational technology used across the web.

For the latest information, see the our incident status page.

What Should Website Owners Do Next?

For websites hosted with Catalyst Visuals, its latest notice indicates that no additional action is required specifically for these vulnerabilities. We manage the relevant hosting-level patching.

Nevertheless, this is a useful reminder to maintain good security practices:

• Keep WordPress and plugins updated. Regularly apply security updates to your content management system, themes, and plugins.
• Maintain a reliable backup strategy. Current, recoverable backups are an important safeguard when unexpected problems arise.
• Monitor your hosting provider’s security notices. Follow official updates when infrastructure-level vulnerabilities emerge.
• Ask questions when something is unclear. If you have concerns about your site’s PHP environment or hosting configuration, contact your hosting provider or website maintenance partner.

These general practices complement hosting-level security measures; they do not replace the PHP patches themselves.

Security Is an Ongoing Commitment at Catalyst Visuals

At Catalyst Visuals, we believe a great website must be more than visually compelling. It must also be thoughtfully maintained, dependable, and built with security in mind.

Our work goes beyond the design and development of websites. We recognize that the technology powering a website continues to evolve long after launch, and that maintaining a secure online presence requires attention to emerging vulnerabilities, software updates, hosting infrastructure, and industry best practices.

Situations like this recent PHP security incident reinforce why we value working with established hosting providers and staying informed about changes that may affect our clients. We appreciate the work involved in identifying vulnerabilities, developing fixes, implementing mitigations, and deploying security updates across complex hosting environments.

We also believe in clear communication. When a security issue makes headlines, our goal is to help clients understand what has happened, what their hosting provider is doing, and whether they need to take action.

Trust is built through proactive attention, informed decisions, and consistent care. We take that responsibility seriously, and we remain committed to helping our clients maintain websites that are secure, effective, and ready for what comes next.

Have Questions About Your Website’s Security?

If you have questions about this PHP security update, your hosting environment, or the ongoing maintenance of your WordPress website, below are a few of the most frequently asked questions over the last few days. Still have questions? Please reach out to us directly!

We combine thoughtful digital experiences with a commitment to the long-term health of the websites we build and support, and open communication along the way.