Webnames.ca Staff
Software has security flaws. Operating systems, programming languages, content management systems, plugins: all of it gets picked over constantly by developers, security researchers and, yes, people trying to break in.
PHP is the latest example. The PHP Security Team announced two vulnerabilities, both rated Critical with a CVSS 4.0 score of 9.2, and said fixes would be released on October 21, 2026. They urged PHP users to update as soon as the patches were out.
PHP runs a huge number of websites, including WordPress sites, and it’s available across our hosting environment. We deployed the patched releases to our hosting servers shortly after they came out. Our website, DNS and email services don’t use PHP, so they weren’t affected.
Here’s what a headline like this actually means for your site, and what we do when the next one comes along.
A vulnerability doesn’t mean your site was hacked.
When a “critical vulnerability” hits the news, it’s natural to worry. But a vulnerability is a weakness that could be exploited under certain conditions. It isn’t proof that every site running the affected software has been compromised.
Once a vulnerability is public, developers, researchers, hosting providers and security vendors assess the risk and decide how to respond. Sometimes that’s just installing the update. Other times, protective measures can cover the gap until a permanent fix is ready.
New vulnerabilities will keep turning up. What matters is how quickly they’re caught, contained and fixed, and what other protections are already in place.
No single tool does it all.
No firewall or product can stop every threat, so we don’t rely on just one. We use several overlapping protections, an approach often called “defence in depth.” Each one covers different risks.
PHP and the hosting platform. We run web hosting on Plesk and offer a range of PHP versions so different sites and applications work properly. We keep those versions updated with the latest patched releases, so security fixes get applied at the platform level. You don’t have to maintain PHP yourself.
That only covers PHP, though. The software running on top of it is a separate matter. A WordPress plugin can have a vulnerability even when PHP is fully patched.
Web application firewall. Our hosting environment is protected by Imunify, which includes a Web Application Firewall (WAF). The WAF sits between incoming Internet traffic and your website, analysing requests and helping block malicious activity, including attempts to exploit known vulnerabilities. Imunify also scans for malware and malicious PHP scripts.
Vulnerability detection in website applications. We also run Patchman. Updating PHP and the server protects the platform, but vulnerabilities can also live in the applications themselves. Patchman detects vulnerabilities and malware in widely used content management systems such as WordPress, Joomla and Drupal, and can apply security patches for supported vulnerabilities.
Extra tools for WordPress. A WordPress site is more than WordPress. Your themes and plugins are part of the application too, and they need to stay patched. All three of our Managed WordPress hosting plans include the standard edition of Plesk WP Toolkit. It covers security checks and hardening, automatic updates, plugin and theme management, staging, cloning and synchronisation, and maintenance and debugging tools. It makes it easier to keep the WordPress side of things secure, on top of the protections we run at the platform level.
Backups. Prevention is only part of security. You also need a way to recover if something goes wrong. We back up our hosting servers and customer websites so we can recover from a total server failure. Customers on any hosting plan other than Value also get two weeks of daily backups in their Hosting Control Panel and can restore from them when needed.
Backups aren’t a substitute for prevention. Restoring an older copy of your site doesn’t fix whatever let the problem happen in the first place.
Security is a shared job.
We look after the hosting infrastructure: the server platform, supported PHP installations and the security tools around your site. You control the software and content inside your own website, so keeping it secure takes both of us.
Website owners should:
- keep WordPress, Joomla, Drupal and other applications up to date
- update plugins, themes, modules and extensions
- remove software they’re no longer using
- avoid plugins, themes and other software that are no longer actively maintained
- use strong, unique passwords for website administration
- turn on multi-factor authentication wherever the application supports it
- limit administrative access to the people who need it
- look into any unexpected changes to website files, content or admin accounts
Updating PHP fixes vulnerabilities in PHP. It can’t fix a flaw in a WordPress plugin, a custom PHP application or anything else you’ve installed yourself.
AI is changing security for attackers and defenders.
AI is changing how software gets written and analyzed. The same tools that help developers and researchers find weaknesses in code can help attackers find them too, 
and automate parts of their work.
So AI-assisted research may mean vulnerabilities are found faster and in greater numbers. But defenders have the same tools. Developers, researchers and security vendors can use AI and automation to analyse vulnerabilities and malicious activity and build defences more quickly.
The upshot is that you may hear about vulnerabilities more often. That doesn’t necessarily mean software is getting less secure. Better tools can surface flaws that might have gone unnoticed for years, and faster disclosure, monitoring, mitigation and patching shorten the time a known vulnerability stays open.
Vulnerabilities will keep showing up.
No hosting provider, developer or security vendor can honestly promise there won’t be another one. A modern website depends on a lot of connected pieces: operating systems, web servers, databases, programming languages, content management systems, plugins, themes, libraries and custom code. All of them change over time, and any of them can have flaws.
So good security doesn’t assume vulnerabilities can be eliminated. It assumes they’ll happen and plans for it: prevent what you can, detect what you can’t, mitigate new threats, patch known problems, and keep reliable backups. That’s how we run our hosting environment.
What Webnames’ customers need to do about the PHP vulnerabilities.
Nothing, as far as PHP itself goes. You don’t need to update the PHP installation provided by your Webnames hosting. We deployed the patched releases shortly after they became available.
You should still keep the applications in your hosting account up to date, including WordPress or other content management systems, plugins, themes and custom applications.
And please don’t assume a vulnerability headline means your site has been compromised. Take security news seriously, but keep it in perspective. Finding, mitigating and patching vulnerabilities is a normal, ongoing part of running anything on the Internet, and we plan for that.