Our entire hosting infrastructure has been updated following the critical PHP security release on 21 October 2026. We completed the rollout within 45 minutes of the patches becoming available.
On 20 October, the PHP security team issued an advance warning about two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both involve how PHP handles memory and could allow an attacker to run malicious code on an affected server without logging in.
PHP is the language that powers WordPress. These vulnerabilities affect PHP installations that handle web requests, including the servers used to host WordPress websites. The PHP team urged administrators to update immediately, making this an urgent security update for hosting providers.
We learned about the issue shortly after the announcement and prepared our infrastructure for the update in advance. The security patches were released on 21 October at 14:00 UTC. By 14:45 UTC, we had finished updating our entire infrastructure.
After patching, we reviewed the available logs and server activity for signs that the vulnerabilities had been exploited before the fixes became available. We found no indications of exploitation or compromise in the evidence reviewed.
If your website is hosted with Awwwsome, this PHP security update has already been taken care of. No action is needed from you.