01 / WordPress & PHP sitesCheck the runtime.
WordPress updates and plugin updates do not necessarily patch PHP. We need evidence about the PHP environment serving your site.
Critical PHP security update · 21 October 2026
Is your website
affected?
New PHP security vulnerabilities have prompted urgent updates. Start with a free public-clue check, then get personal support if you need it.
No signup or payment. Public clues, not a security verdict. Personal assessments from £49.
Free PHP website check
A quick check.
A useful next step.
Enter your website to look for public PHP clues. If it advertises a version below the 21 October security fixes, we’ll flag it and explain what to ask your host.
Free · No signup · No changes to your website
Public clues are a starting point. They cannot confirm that your website is vulnerable, patched or secure. Hidden versions are common.
This comparison covers the two 21 October advisories.
The update, in 30 seconds
A server update.
A sensible next step.
On 21 October, the PHP project released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. In affected environments, they can allow attackers to run code on a server.
PHP helps power WordPress and many other websites. Your host may already have updated it. The useful next step is to establish what your website actually runs and whether the relevant fixes are in place.
Checked 26 October 2026. Read the PHP announcement and NCSC guidance.
Could this apply to you?
The platform is
only part of the picture.
01 / WordPress & PHP sites
02 / Managed hostingYour host may have it covered.
Ask for confirmation for your specific website. Some providers apply their own backported fixes, so a version number alone may be misleading.
03 / Static websitesNo PHP? Different situation.
A static site with no PHP runtime is not affected by these particular vulnerabilities. Separate applications and hosting services may still need checking.
A public website address cannot reliably establish PHP patch status. We use hosting information, vendor guidance and authorised evidence.
Clear scope. Clear prices.
Understand first.
Update if it’s needed.
Start here
PHP Security Check
£49 one website
A focused review to help you make the next decision.
- Identify the platform and hosting arrangements
- Review available PHP version and patch evidence
- Establish who is responsible for updates
- Short written findings, unknowns and next steps
Up to 1.5 hours of total work. Evidence review only; no exploit testing, certification or repairs.
Ask about the £49 check ↗For eligible, straightforward sites
Check + Assisted Update
£149 total, including the check
Help applying or coordinating a supported host-approved patch.
- Everything in the £49 assessment
- Agreed access, compatibility and recovery checks
- Assistance with an appropriate PHP patch
- Agreed functional checks and completion report
One managed-host site; same supported PHP branch. Up to 5 hours total including assessment, admin, testing and recovery reserve. Eligibility confirmed first.
Discuss update assistance ↗Already paid £49 for the same site? It is credited in full: the remaining package balance is £100. No VAT is added.
Some jobs need a different plan.
Major PHP upgrades, incompatible code or plugins, shops, multisite, high-risk data, custom server work and suspected compromise are outside the £149 package. A tested recovery route and suitable hosting support are essential. I’ll explain a separate quote or referral before further work. Hosting and licence costs are separate, agreed in advance.
How it works
From a question
to a practical next step.
Tell me about your website.
Share its address and anything you know about the host. No passwords or payment details.
We establish the evidence.
We agree the scope before paid work. Then I review the technology, patch status and who can act.
You get a clear answer.
Written findings distinguish what is known, what needs confirmation and any suitable update assistance.
The Digital Weevil approach
Useful advice.
Without the alarm bells.
I’m Sam, the person behind Digital Weevil. I help independent businesses make sense of their websites and digital tools.
For this service, that means clear findings, straightforward prices, respect for your information and no unnecessary updates. If specialist help is needed, I’ll say so.
This is a focused PHP patch assessment, not a penetration test or a guarantee that a website is secure. Applying a patch does not establish that an exposed site was never compromised.
Meet Sam ↗A few useful answers
Website security,
in plain English.
What is PHP?
PHP is software that runs on a web server to help create pages and handle requests. WordPress and many other website systems use it. Your hosting company often manages it.
Is my WordPress site affected?
WordPress uses PHP, but that alone does not confirm exposure. The running PHP version, vendor patch status and server setup matter. Updating WordPress or plugins alone does not necessarily update PHP.
How can I tell which PHP version my website uses?
Your host’s control panel or support team is a good starting point. WordPress Site Health may show a version, but the website’s running environment and any vendor backport still need confirming. Avoid publishing a phpinfo diagnostic page: it can expose server information.
Can my hosting company fix this?
Often, yes. Ask whether the PHP runtime serving your specific site has received fixes for both CVEs. Some hosts have already applied updates. An answer linked to your site and environment is more useful than a general announcement.
What if I don’t know who hosts my website?
Tell me what you do know. A hosting invoice, provider name or account dashboard can help establish responsibility. Please remove billing details and never send a password through this form.
What if my website doesn’t use PHP?
A static website with no PHP runtime is not affected by these PHP runtime vulnerabilities. That does not assess unrelated systems or other security issues. If this is clear before paid work starts, I’ll explain that rather than recommend an unnecessary check.
What if my website has already been hacked?
Tell your hosting provider promptly. Suspected compromise needs specialist incident-response help. This service does not investigate incidents or remove malware, and a PHP update cannot establish that a previously exposed site is clean.
Does the £49 assessment include fixing vulnerabilities?
No. It covers one website, evidence review and a short written assessment, with up to 1.5 hours of total work. The £49 is credited in full if the same site proceeds with the eligible £149 package.
What happens if the work is more complicated?
Scope and eligibility are agreed before production changes. If the job is unsuitable or needs more work, I explain the unknowns and a separate quote or referral. Major version changes, broken code, shops, multisite, custom servers and suspected compromise are excluded. The time cap does not remove agreed recovery or correction obligations. No extra paid work starts without agreement.
How quickly can Digital Weevil help?
The free public-clue lookup is automated. I review enquiries personally and confirm availability before you book; the personal assessment is not instant. If your site needs urgent attention, contact your host while you wait.
Let’s take a look
Start with
your website.
Tell me what you know. I’ll review your enquiry and confirm whether the service is suitable, the scope and availability before you book.
An enquiry is free and creates no payment obligation. No work or production changes begin without your agreement.
Keep access details private.
Never send passwords, login links, payment information or customer records here. If access is needed, we’ll agree a secure method separately.
If you suspect a hack or need an urgent update, contact your hosting provider now. This form is not an emergency response service.