Security updates have been released to address two critical vulnerabilities in PHP, a technology used by WordPress and many other websites.
For clients using Redfox’s managed WordPress hosting through Pagely, the required PHP security updates have already been deployed. You do not need to take any action in relation to this update. (status.pagely.com)
What has happened
Two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been disclosed in PHP. Both have been classified as critical and may allow an attacker to run malicious code on a vulnerable server without needing to log in.
This is known as unauthenticated remote code execution. A successful attack could put a website and the information it handles at risk, which is why the PHP development team has urged users to update immediately. (php.net)
Why the hosting environment matters
PHP runs on the server that hosts your website. It is part of the software WordPress relies on to function, even though most business owners never need to interact with it.
Addressing these vulnerabilities requires a PHP security update in the hosting environment. Updating WordPress, themes or plugins alone does not apply these PHP fixes. (php.net, wordpress.org)
That distinction matters when a security issue is announced. Someone needs to be responsible for reviewing the advisory and applying the relevant server updates.
The update for Redfox hosting clients
Pagely, the provider behind our managed WordPress hosting service, has confirmed that the updates have been deployed across its customer servers.
Its advisory was marked resolved at 5:51 am AEDT on Thursday 22 October 2026, equivalent to 18:51 UTC on 21 October. Clients hosted through Redfox on this platform do not need to arrange a separate PHP update for these vulnerabilities. (status.pagely.com)
If your website is hosted elsewhere
Contact your hosting provider promptly and ask them to confirm that the fixes for CVE-2026-109618 and CVE-2026-109619 have been applied to the environment running your website.
A website can appear to be working normally while still running vulnerable software, so checking that it loads is not enough to confirm the update.
Why we take managed hosting seriously
Much of the work involved in maintaining a website happens out of sight. Security updates rarely change how a website looks, but they are an important part of keeping it running reliably.
For a business owner, the useful question is who is keeping track of the underlying software and taking responsibility when an urgent update is required. It is one of the reasons we see managed hosting as an important part of caring for a business website.
If you are unsure whether your website is hosted with us, or have questions about this update, contact the Redfox team.
