If you have seen the headlines about websites being taken offline, it is reasonable to ask whether yours is affected. For our OliveCore clients, the key point is straightforward: OliveCore runs on Microsoft's .NET platform. These particular vulnerabilities are in PHP, which OliveCore's application code does not use.
That gives us a specific answer about the platform. Separate services, such as a WordPress blog, hosting control panel or another application sharing a server, still need checking on their own merits. If you are unsure what is included in your setup, get in touch and we can talk it through.
What has happened?
On 21 October, the BBC reported websites being taken offline following a critical PHP security alert. PHP is software running on the server behind many websites. The problem is in that underlying software, so updating a page or changing a password does not fix it.
The PHP project has published fixes for two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can let an attacker run code without signing in. Its official advisory calls for immediate updates. This reaches beyond any one CMS or plugin.
How to check your own website
Start with whoever manages your hosting. You want an answer about the software actually serving your website, not a guess from how the pages look. These checks do not require sending attack traffic to your site.
- Identify the runtime. Ask whether your site uses PHP, including any separate shop, blog, subdomain or older application still online. In a hosting account, look for the PHP settings assigned to the specific domain. A blank result from a website technology detector is not proof that PHP is absent.
- Confirm the patch, not just the CMS version. Ask your host which PHP version or vendor security package is running for that site, and whether it fixes both CVEs above. A WordPress update is not the same thing as a PHP update.
- Check the services around it. The NCSC advises checking infrastructure and third-party products that may include PHP. Your main website can use a different language while an associated tool still needs a patch.
- Verify after the update. Have the administrator confirm that the web-serving processes are running the patched version, then check pages, sign-in, search, uploads and forms with harmless test data. Confirm that a test enquiry arrives. A working page checks functionality; it does not prove that the vulnerability is fixed.
If an administrator uses php -v, that reports the command-line installation. The website may use a different version or handler. Ask them to verify the web runtime too, without leaving a public diagnostic page exposing server information.
What to do if PHP is involved
The fixed releases announced today are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Use the fixed release for your supported branch, or a later security release. Some hosting and operating-system vendors backport security fixes, so get confirmation of the package's patch status rather than relying on the version number alone. For older branches, ask the vendor about a supported upgrade or a verified backported fix. See the PHP release guidance.
CERT-EU recommends immediate patching and considering isolation from public networks where that cannot be done. Its advice is clear that temporary measures are not a complete fix. Let the person responsible for the server assess that decision, including any effect on your business services.
Patching also does not establish whether a server was compromised beforehand. Where there has been exposure or suspicious activity, ask the administrator to review it and follow the NCSC's incident guidance.
Where OliveCore fits
We build OliveCore on Microsoft .NET and SQL Server, with our own application code. That is why this PHP incident does not affect the OliveCore application itself. It is a statement about these vulnerabilities, not a claim that any technology is immune to security problems.
For a business owner, the useful part of a bespoke build is knowing what runs your site, who understands it and who maintains it. We can design around the way your business works, with the features and integrations you need and a clear view of the components underneath. Our security approach explains how we handle that responsibility.
If the headlines have prompted you to look more closely at your current website, we are happy to discuss it. And if you are considering a bespoke OliveCore build, tell us what you need it to do. We can talk through whether it is a sensible fit.
Checked against PHP, NCSC and CERT-EU guidance on 21 October 2026. This is a developing incident; follow the linked advisories and your hosting provider's current instructions.
