01. The Context
On Wednesday, 21 October 2026, the PHP development team released an emergency security update addressing two critical vulnerabilities affecting PHP, a widely used technology that powers millions of websites and online applications worldwide.
These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have been classified as critical, each carrying a severity score of 9.2 out of 10.
If successfully exploited, these vulnerabilities could allow an unauthorised third party to execute malicious code on affected servers, potentially compromising website functionality, security and sensitive information.
As a result, website owners and hosting providers worldwide are being advised to apply the latest security updates without delay.
02. Our Approach
At Vers Creative UK, the security and reliability of our customers' websites and digital services remains one of our highest priorities.
Following these security vulnerabilities being identified worldwide, our teams have been working with our providers to ensure that security patches provided for PHP are applied accordingly to our services.
We can confirm the following at this stage:
- All of our in-house dedicated cloud solutions, for all websites, apps and services, have been patched to the latest PHP versions including the required security updates.
- We are working with our shared hosting provider (IONOS) to patch and implement additional security measures for all other services, including internal portals and customers on legacy services with us.
- Any and all updates have and will be applied with appropriate consideration for website and application functionality.
- All active customer websites and attached hosting environments are protected against these security concerns.
- Some of our services may be temporarily offline whilst these updates are completed. This is to ensure no customers are affected and our systems remain secure. At this time, we estimate that this may take up to 48 hours.
03. Your Sites & Services
Following any changes and updates to your sites and services, once these are restored they will continue as normal.
We wish to reassure our customers that, whilst this incident may have caused some concern, these types of incidents are common within the world of technology and these updates and processes are part of our routine and our teams have ample experience in dealing with them.
Will my website be affected?
Many of our customer sites, applications and services utilise PHP, so there is a high likelihood that your site will be affected. The level of exposure will depend on the technologies and hosting environment involved.
Most of our services have already been securely patched and any remaining services may be subject to brief service interruptions while security updates and compatibility checks are performed.
Where maintenance is required, we will endeavour to minimise disruption and communicate any significant service impact.
Any customers whose sites require additional security measures will be contacted directly by our team to advise next steps.
Do I need to do anything?
As noted above, customers whose websites and hosting environments are fully managed by Vers Creative UK do not need to initiate any changes unless contacted directly.
As always, we advise any customers who manage integrations or part of their own services which utilise PHP installations should ensure they are running a supported, fully patched version of PHP.
If you have any concerns or are unsure whether your website is affected, please contact our support team for guidance.