Dear Clients,
We'd like to inform you of an important security development affecting PHP, the programming language used by many websites, including WordPress and other web applications.
On October 21, 2026, the PHP development team released emergency security updates addressing two critical vulnerabilities:
-
CVE-2026-109618: A vulnerability involving PHP's memory handling.
-
CVE-2026-109619: A vulnerability involving PHP's internal processing of web requests.
Both vulnerabilities received a critical severity rating of 9.2 out of 10 and could potentially allow unauthorized individuals to execute code on vulnerable servers without logging in.
These are vulnerabilities within PHP itself, not specific to WordPress or any particular website. The announcement does not mean that your website has been compromised.
What Scarlett's Web Is Doing
As part of our fully managed hosting services, we're coordinating with our hosting providers to deploy the necessary security patches across affected servers.
Scheduled maintenance: October 21, 2026, throughout the evening (Eastern Time).
Our hosting providers are applying security updates as they become available. Maintenance schedules may vary by server and hosting environment.
No downtime is expected, although brief interruptions or temporary performance changes are possible during maintenance.
Where supported, these security patches will be applied without requiring a major PHP version change, helping maintain compatibility with existing websites.
Is Any Action Required?
No action is required for clients hosted on our fully managed servers.
We're handling these updates at the server level and will continue monitoring the affected environments.
If your website is hosted independently through another provider, we recommend confirming that your hosting company is applying the appropriate PHP security updates.
If you notice any unusual website behavior, please submit a support ticket through your Scarlett's Web client area.
Additional Information & Official Sources
For clients interested in learning more about these findings:
-
PHP Development Team: Official Security Advisory, October 21, 2026
-
Wordfence: PHP Security Updates for Two Critical Vulnerabilities
-
Liquid Web: Hosting Infrastructure Status & Security Updates
We take website security seriously and appreciate your continued trust in Scarlett's Web. We'll provide additional information if any client action becomes necessary.
Thank you!
Scarlett's Web, Inc.
Managed Hosting & Technical Support
