You may have seen the news this week about a serious security flaw affecting websites around the world. Here’s what it means in plain English, and what (if anything) you need to do.
The short version: if your website is on hosting and maintenance with Fertile.Digital, we are applying the fix for you and there is nothing you need to do. If it isn’t, you need to check with whoever hosts your website today.
What has happened?
Most websites, including every WordPress site, run on a piece of behind-the-scenes software called PHP. Think of it as the engine under the bonnet. You never see it, but your website can’t run without it.
On 21 October, two serious faults were found in that engine. In the wrong hands, they could let someone take control of a website’s server without a password. Security experts have rated the problem as critical, and attackers have already started trying to use it. The flaw has been nicknamed PHP2Shell (officially, CVE-2026-109618 and CVE-2026-109619), and you can read a technical write-up here if you want the detail.
Two things are worth knowing:
- This isn’t a problem with your website’s design, content or plugins. It sits in the hosting server itself, so keeping WordPress up to date doesn’t fix it.
- It can only be fixed by the company that hosts your website. They need to update the server to a corrected version of PHP.
If you’re on a Fertile.Digital Care Plan
You’re covered. We are updating all our clients’ websites on our Care Plans to the corrected version of PHP.
There is nothing you need to do. We’ll keep monitoring and will let you know if anything changes.
If your website is hosted elsewhere
If we built your website but you host it with another company, or you look after it yourself, you need to check with your hosting provider. Don’t assume it’s been done.
A simple way to ask them:
“Has the PHP security fix from 21 October 2026 (PHP2Shell) been applied to the server my website runs on, and what version of PHP is it now running?”
The answer you want is a version number of 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or higher, or written confirmation that the fix has been applied another way (some hosting companies apply security fixes without changing the version number, so a lower number isn’t always bad news). If your site is on an older version of PHP (anything starting 7 or 8.0 or 8.1) and they can’t confirm a fix, ask them what they’re doing about it, as some older versions won’t get one.
If you’re not sure who hosts your website, or you don’t get a clear answer, get in touch and we’ll help you find out.
Want this sorted for you next time?
Security issues like this one don’t come with much warning, and this won’t be the last. Our hosting and maintenance plans start from £50 a month and mean we handle the updates, backups and security fixes so you don’t have to think about them.
Find out more on our website maintenance page, or give us a call and we’ll talk you through it.
Information correct as at 22 October 2026. Security situations move quickly; we’ll update this page if the advice changes.
