Following the discovery of two critical PHP security vulnerabilities, HITS has confirmed that all websites within our dedicated managed hosting environment have been successfully patched and protected.
Following widespread reports of the vulnerabilities, we received a number of enquiries from clients concerned about the security of their websites. We wanted to provide an overview of what happened, how our technical team responded and why our managed hosting infrastructure allows us to act quickly when security threats emerge.
What Happened?
On 20 October 2026, the PHP security team issued an advance warning regarding two critical vulnerabilities affecting PHP, the programming language used by WordPress and millions of websites worldwide.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were both rated 9.2 out of 10 for severity and could potentially allow attackers to execute malicious code on vulnerable servers.
Official PHP security updates were subsequently released on 21 October 2026 to address the vulnerabilities.
How HITS Responded
At HITS, website security is a priority, and our technical team responded immediately following the initial announcement. Our response was carried out in two stages.
Early Protection: Within 20 Minutes
Following the initial security advisory on 20 October, our technical team assessed the warning and implemented early protective measures across our managed hosting infrastructure.
Within just 20 minutes of the initial advisory, our early protection was in place, reducing potential exposure ahead of the official PHP security release.
Official Security Update: All Sites Patched Within 15 Minutes
On 21 October, the PHP security team released the official updates addressing both vulnerabilities.
Our technical team immediately deployed the updated security patches across our managed hosting infrastructure.
Within just 15 minutes of the official release, all client websites managed by HITS had been successfully patched.
This two-stage response demonstrates the importance of proactive security management and having the infrastructure in place to respond quickly.
HITS UltraFast PHP: Built for Performance and Security
Unlike conventional hosting configurations, HITS operates a customised PHP environment we like to call UltraFast PHP.
Our UltraFast PHP configuration has been specifically tailored to our hosting infrastructure and optimised for WordPress, providing greater control over performance, compatibility and security.
One of its key advantages is our ability to manage PHP configurations and implement security updates centrally, without relying on individual website owners to take action.
This allows us to respond rapidly to emerging threats while maintaining a consistent and controlled hosting environment across our client websites.
Do HITS Clients Need to Take Any Action?
No. All websites managed by HITS have already received the necessary security updates.
Clients do not need to manually update PHP, install additional software or make changes to their WordPress websites in response to these vulnerabilities.
Our technical team will continue monitoring the situation and implementing any further security measures if required.
Website Security Is an Ongoing Responsibility
At HITS, security is not something we only address when a major vulnerability makes the headlines.
Our managed hosting service is designed to take the responsibility of maintaining, updating and protecting websites away from our clients, allowing them to concentrate on running their businesses.
While no hosting environment can guarantee complete protection against every possible security threat, we remain committed to identifying risks early, responding promptly and maintaining a secure and reliable environment.
Our response to these critical PHP vulnerabilities reflects that commitment, with early protection implemented within 20 minutes and all client websites patched within 15 minutes of the official release.
For further technical information, please refer to the official PHP security announcements or the UK National Cyber Security Centre’s advisory.
If you have any questions regarding your website’s security or our managed hosting services, please contact the HITS team.
