Urgent: Check Your Website, PHP Security Update

We’re sending this notice as a courtesy to all our clients and friends of Insource so you know what’s happening regarding a time-sensitive security concern. If Insource already manages your IT systems, we’re already on it and will reach out if we need anything from you. If we don’t manage your website or you aren’t sure who does, read on and feel free to contact us for any assistance. 

What happened 

A serious security flaw was found in PHP, the software behind a large share of websites, including every WordPress site. A fix came out on October 21, and attackers are already going after sites that haven’t been updated. 

What you need to do 

Reach out to whoever manages your website, i.e. your web host, developer, or IT team, and ask one question: “Have we applied the October 21 PHP security update?” If they want specifics, it’s CVE-2026-109618 and CVE-2026-109619. 

You’re looking for a clear yes. If the answer is no or “we’re looking into it,” ask when it will be done. This one shouldn’t wait. 

How Insource can help 

If you aren’t sure who manages your website, feel free to contact us and we’ll help you get to a yes. We’re also offering a free, no-obligation security scan of your environment that checks for any other outdated software and security gaps that attackers often target alongside flaws like this one. To book your scan, just contact us and we’ll take it from there. 

Sources 

• The Hacker News: PHP Issues Emergency Patches for Two Critical PHP2Shell RCE Flaws 

• Help Net Security: PHP2Shell: Critical PHP vulnerabilities patched, update now!