Website Security: What Every Website Owner Needs to Know

1. What to do now: the critical PHP vulnerabilities

On 21 October 2026 the PHP project released security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 out of 10 and can allow remote code execution on a server that has not been updated. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Six steps

1. Find out whether your site uses PHP. In WordPress, go to Tools, then Site Health, then Info, then Server. Otherwise ask your web host or IT supplier.
2. Check the PHP version. It should be 8.5.12, 8.4.27, 8.3.36, 8.2.35 or newer. If your host runs an older branch that is not listed, ask whether it has been patched or upgraded.
3. Make a fresh backup before you update, and check that you can restore it.
4. Ask your host to update PHP and to confirm in writing. Then update your CMS and plugins.
5. If you cannot update right away, follow the advice from CERT-EU: consider isolating internet-facing applications from the public network until a fix is in place. For a small site, that can mean taking it offline or restricting access for a while.
6. Keep watching. Check your logs for unusual activity, look for unexpected administrator accounts or changed files, and change administrator passwords if you are in doubt.

Authorities in several countries, including the EU, the US, Germany, the UK, Japan and Australia, issued warnings. The Danish business organisation Dansk Industri estimated on 22 October that at least 28,000 Danish websites had not yet been updated; we have not been able to verify how that number was measured. Reports differed on how much active exploitation had been observed at that point.

2. Why website security matters

A compromised website can have consequences beyond a temporary technical problem. Depending on the incident, a business may experience:

• Website downtime: customers cannot reach your website or services.
• Unauthorised changes: attackers may alter pages or insert malicious content.
• Data exposure: information stored or processed by the website may be at risk.
• Loss of trust: visitors may lose confidence in your business if the website is compromised.
• Unexpected costs: investigation, recovery and technical repairs consume time and money.

Not every website faces the same risks. The level of exposure depends on its technology, configuration, functionality and how it is maintained. That is why security should be considered from the beginning, not only after something goes wrong.

3. The challenge of traditional website technology

Many websites rely on a combination of technologies: a server environment, a content management system (CMS), plugins, themes and third-party services. Each component has its own role, but each may also bring maintenance requirements and security considerations.

A typical website may depend on a supported server-side programming language and runtime, a CMS that receives regular security updates, plugins and themes that stay compatible and supported, secure hosting with correctly configured permissions, and reliable backups with a process for responding to security alerts.

The challenge is not simply the number of components. It is knowing which components your website depends on, who maintains them, and how quickly vulnerabilities can be addressed. A system that is no longer supported can be particularly problematic, because security fixes may no longer be available.

4. Why PHP security updates matter

PHP is a widely used server-side programming language that powers a large part of the web. Like any software, it can contain vulnerabilities that need security updates. PHP itself is not inherently insecure: supported versions receive security fixes, and WordPress and other systems continue to support modern PHP versions. Keeping the runtime updated is an essential part of website security.

The incident in October 2026 shows why it matters. Within hours of the disclosure, Cloudflare reported attack attempts rising from thousands to millions, according to Computerworld. Some services were taken offline temporarily as a precaution, among them the Danish Aula platform, which has since returned. The practical lesson is simple: when your website depends on software with a critical vulnerability, the speed at which you can find out and apply the fix matters.

5. The hidden maintenance behind a website

A website may look simple to visitors while relying on a complex technical foundation behind the scenes. Depending on the platform, ongoing maintenance can include:

• Software updates: keeping the CMS, server software, programming language and other components on supported versions.
• Plugin and theme management: checking compatibility, following security announcements and removing components that are no longer needed or supported.
• Backups and recovery: keeping backups and knowing how to restore the website if something goes wrong.
• Access management: strong passwords, multi-factor authentication where available, and sensible permissions for administrators.
• Security monitoring: recognising suspicious activity and responding in time.

These responsibilities do not disappear because a website looks modern. The important question is how much of the technical maintenance falls on you, your web developer or your platform provider.

6. A practical website security checklist

If you own or manage a website, start by asking these questions:

• Do I know which platform and technologies my website uses?
• Are the software and components still supported?
• Who is responsible for applying security updates?
• Have unnecessary plugins, extensions and services been removed?
• Are administrator accounts protected with strong passwords and multi-factor authentication where available?
• Are backups maintained, and has recovery been tested?
• Is HTTPS configured correctly?
• Do I know who to contact if a vulnerability is announced?
• Do I understand which parts are managed by my provider and which are my responsibility?

If you cannot answer several of these questions, it may be time to review your setup with your provider or a qualified technical professional.

7. Is there an alternative to a PHP-based platform?

For businesses planning a new website or tool, it is worth looking beyond appearance, templates and price. The underlying architecture matters too. Some platforms depend on PHP and need a PHP runtime to operate. Others are built on different technologies and do not depend on PHP.

A solution without a PHP dependency removes the need to maintain PHP for that solution. It does not, by itself, remove every security risk, but it offers a different technical foundation. When you evaluate an alternative, ask:

• Which technologies does it actually use?
• Who maintains the underlying infrastructure?
• How are security updates handled?
• How are user access and data protected?
• What backup and recovery options exist?
• Which security responsibilities remain with me?

The goal is not to choose a platform on a single technology. It is to understand its dependencies and choose a solution whose maintenance and security model fits your business. For a balanced look at the trade-offs, read our honest comparison of PHP-based websites and solutions without PHP.

8. A different approach to building websites

The solutions we build, such as OwnSurvey, LeadsLeak and Savings Check, run without PHP. They are JavaScript applications on a modern cloud platform, so there is no PHP runtime for the customer to patch, and they are not affected by the two PHP vulnerabilities published on 21 October 2026.

That does not make them risk-free. They have their own components, and account security, access control and backups matter just as much. No website platform can guarantee complete protection against cyberattacks. Security depends on the whole technology stack, configuration, hosting, access controls and maintenance.

A website should support your business, not leave you uncertain about what is running behind the scenes.