The servers supporting JM Restart’s cPanel website hosting have been patched for the critical PHP security issue highlighted by the National Cyber Security Centre (NCSC). If your website uses this hosting service, you do not need to install the server patch yourself.
Hosting status as at 22 October 2026. This update covers our cPanel website-hosting platform. It is not a statement about every customer-owned server, separately hosted application or service elsewhere. If you are unsure where your website runs, we can help check.
You do not need to raise a ticket simply to request this PHP patch for the hosting covered above. You are still welcome to contact us if something is not working or you would like reassurance.
What happened and what is PHP
PHP is software that runs on a web server and helps generate website pages. WordPress uses it, as do many other website platforms and applications. It is separate from the web browser on your computer.
On 21 October 2026, the NCSC published an alert about two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. In affected installations, an attacker could potentially run commands without signing in. The PHP project released security updates; applying the fix is the essential response.
A vulnerability is a weakness that needs addressing. An alert does not, by itself, mean that your website has been compromised. Equally, applying a patch does not establish whether a site was affected beforehand; suspicious activity still needs investigation.
Why the displayed PHP version may not change
The fix on our hosting platform has been applied to the existing PHP version. This is often called a backported security fix: the repair is brought into the installed software branch rather than requiring a change to a different major version. An unchanged version number in your control panel does not necessarily mean that this fix is missing.
A server patch, a WordPress update and a security-plugin update are different jobs. Changing a setting or installing a plugin is not a substitute for the PHP security fix. Do not change your site’s PHP version or security settings just to match a number seen online; ask us to check the appropriate arrangement.
Security included with our website hosting
The cPanel hosting platform we use includes several complementary protections:
- Server patching and updates to address problems in the hosting software.
- Regular virus and malware scanning to help identify harmful files in hosting accounts.
- Firewalls and distributed denial-of-service (DDoS) protection to help filter hostile traffic, including attempts to overwhelm a service.
- CloudLinux-based hosting with account separation and resource-control capabilities.
- SSL/TLS certificates for encrypted HTTPS connections between visitors and a correctly configured website.
- Daily off-site hosting backups to support recovery when a suitable restore point is available.
These layers reduce risk, but they do not make a website immune to attack or guarantee uninterrupted service. HTTPS protects the connection; it does not prove that a website’s content is trustworthy. Backups support recovery, not prevention, and changes made since the last backup may not be present in a restore.
How we use cPanel and WHM
cPanel is the control panel for an individual hosting account, with tools for files, databases, domains and other hosting settings. WHM, or WebHost Manager, helps us administer hosting accounts and their allocations. They are management tools, not security guarantees or a claim that each website has its own dedicated server.
Managing the hosting platform is only one part of website care. Keeping WordPress, themes and plugins suitable and up to date needs its own agreed responsibility.
Wordfence and Loginizer on WordPress websites
We use WordPress security tools according to each site’s needs, rather than assume that every website needs an identical plugin setup. Wordfence provides a WordPress firewall and malware scanning, alongside other security tools. Available features and the timing of new protection depend on the edition; the free edition receives new firewall rules and malware signatures after a 30-day delay.
Loginizer helps limit repeated failed login attempts, making automated password guessing more difficult. It supports login protection, not the repair of a vulnerable PHP installation.
More security plugins do not automatically mean better protection. Their settings need to work together. Strong, unique passwords, appropriate administrator access, multi-factor authentication where available and maintained software still matter.
Website hosting does not automatically include every WordPress update, paid plugin licence, monitoring task or incident-cleanup service. We agree maintenance, backup and response responsibilities for your particular website.
What website owners should do
- If your website uses the cPanel hosting covered by this update, there is no server patch for you to install yourself. Ask us if you are unsure whether your site is included.
- If your website or application runs elsewhere, ask its administrator or hosting provider to confirm that the relevant PHP security fixes have been applied. An older installation may need a supported upgrade or a vendor-maintained fix.
- Keep your agreed website-maintenance arrangements current. Do not assume that patching PHP also updates WordPress, themes or plugins.
- If you notice unexpected pages, redirects, unfamiliar administrator accounts or warnings, contact us. Avoid deleting files or restoring a backup before the issue has been assessed.
Support even when your website is hosted elsewhere
Your website does not have to be hosted with JM Restart for us to help you understand a security alert.
For one business customer, our initial public checks identified WordPress components. We helped prepare a request asking their website provider to confirm the PHP installation serving the site and whether the required security fixes had been applied.
That confirmation is still awaited. A website loading normally does not prove that its underlying software has been patched. Where another provider manages the hosting, we can help you ask the right questions and understand their response.
Practical website support from JM Restart
You do not need to manage this alone. We can help identify your hosting arrangements, review website maintenance and backups, and agree sensible next steps. Our website builds, hosting and WordPress support service covers individually agreed work, including support for existing websites and migrations.
For a website enquiry, send the domain name and a brief description of what you need. Please do not send passwords or authentication codes in ordinary email or through an enquiry form.
