When the recent and very serious PHP security vulnerability was announced in October 2026, our server support team acted immediately to help protect our client websites.

Rather than waiting for the official PHP patches to be released, our team quickly deployed additional Web Application Firewall (WAF) rules across our managed hosting environment. These emergency protections were designed to identify and block suspicious requests associated with the vulnerability, helping to reduce risk while a permanent fix was being prepared.

As soon as the official PHP security updates became available, the support team rolled out the relevant patches across affected websites and hosting platforms. They also reviewed and backdated updates to legacy websites to ensure older installations received the same level of protection wherever possible.

Our response followed three key steps:

1. Immediate mitigation through enhanced WAF protection.
2. Rapid deployment of official PHP patches as soon as they were released.
3. Retrospective updates to legacy websites to minimise exposure and maintain security standards.

The speed of our server support team's response meant clients benefited from protective measures before the official patches were available, followed by prompt software updates once they were released.

Website security is not just about applying updates. It's about monitoring emerging threats, acting quickly when risks are identified, and ensuring every site, including older platforms, remains as secure as possible.

That's exactly the approach we take.