This week, vulnerabilities in the PHP programming language, on which a large part of the web runs, including most WordPress sites, made headlines around the world. Here is a short summary of what happened and how the websites we maintain are protected.
What happened
Two critical vulnerabilities were published: CVE-2026-109618 and CVE-2026-109619 (also known as PHP2Shell). They allow remote execution of malicious code on a server. The PHP developers released patches immediately, but attackers began testing the vulnerabilities even earlier. The Slovenian information security office rated the threat level as high, while SI-CERT is not currently reporting major problems in Slovenia.
What we did
- We checked the servers hosting our own and our clients’ websites.
- Our host Domenca installed CloudLinux security patches on all managed servers on 22 October and additionally updated the firewall (Imunify360 WAF).
- We moved to the newer PHP 8.4 version and further hardened the site, including disabling comments and pingbacks that bots exploit.
- We are monitoring further updates and staying in touch with the host.
Do you need to do anything?
If your website is with us, no. We take care of updates, backups and monitoring. If your website is hosted elsewhere, we advise checking with your host that the patches are installed and updating WordPress, plugins and themes regularly. If you are a website visitor, you do not need to take any action.
An important note
No protection is one hundred percent. That is why we do not rely on a single measure but on several layers: an updated server, a firewall, regular updates and backups. If you would like us to review your website too, write to us at info@kreativnisplet.si.
