Protecting our client hosted websites and online services is a top priority. Following the disclosure of two critical security vulnerabilities affecting PHP, we have proactively reviewed and updated all hosted environments under our management to ensure continued security and stability.
What Happened?
On the 21st October 2026, the PHP development team released emergency security updates to address two critical vulnerabilities:
- CVE-2026-109618
- CVE-2026-109619
These vulnerabilities, collectively referred to by some security researchers as “PHP2Shell”, could potentially allow unauthenticated attackers to execute malicious code on vulnerable web servers under certain conditions. Security agencies, including the National Cyber Security Centre (NCSC), have advised organisations to take immediate action and update affected PHP installations. See Critical security issue affecting PHP | National Cyber Security Centre for further information.
The vulnerabilities affect PHP’s internal handling of web requests and have been assigned a critical severity rating. Importantly, the PHP project has advised that patching is the only reliable way to fully mitigate the risk.
Are you affected?
As part of our ongoing security management procedures, we immediately reviewed all web hosting platforms and customer websites under our management following publication of the security advisory.
We can confirm that:
- All managed hosting platforms were assessed against the published vulnerabilities.
- PHP versions in active use were reviewed and updated where required.
- Servers have been patched to versions containing the official security fixes.
- No evidence of compromise has been identified within our managed hosting estate.
Why Security Updates Matter
Modern websites rely on many software components working together. Even when a website itself hasn’t changed, vulnerabilities can occasionally be discovered within the underlying technologies that power it.
Prompt patching is one of the most effective ways to reduce cyber risk. Our managed hosting services include ongoing monitoring of security advisories and the timely deployment of critical updates where appropriate, helping to keep customer websites secure and compliant with current best practices.
Our Ongoing Commitment
Cybersecurity is not a one-time exercise. We continually monitor industry security bulletins, vendor advisories and emerging threats to ensure our hosted environments remain protected.
Should you have any questions regarding our hosting environment or website security, our team is always available to help.
The new window display is integrated fully with the Masson Glennie website, displaying live data, and can be easily updated throughout the day by Masson Glennie staff members.
