Your website brings in enquiries, takes orders and helps customers decide whether to trust your business.
So why is the hosting keeping it running sometimes treated like the cheapest item on the shopping list?
The recent critical PHP vulnerabilities have put website security firmly in the headlines. They are also a reminder that good hosting involves far more than keeping a website online.
When a serious security issue appears, who is looking after your website, how quickly do they act, and can they explain what has been done?
Those are the questions worth asking.
What has happened?
In October 2026, two critical security vulnerabilities were disclosed in PHP, the programming language that powers WordPress and many other websites and applications.
The flaws, identified as CVE-2026-109618 and CVE-2026-109619, involve how PHP handles memory. Under certain conditions, they could allow an attacker to run commands remotely without logging in.
The National Cyber Security Centre’s advisory urges organisations to identify systems using PHP and apply the relevant security updates. It also makes clear that organisations should assess PHP installations generally, rather than assuming only outdated versions need attention.
A vulnerability does not automatically mean a website has been hacked. It does mean the necessary protections and fixes need prompt attention.
Why has this caused so much concern?
PHP sits behind a huge range of websites and services. A vulnerability in that underlying technology can therefore affect far more than one website, plugin or business.
OpenAI’s disclosure report explains that researchers used AI to help uncover the flaws, with PHP’s maintainers leading the fixes and release. Hosting companies, security providers and other organisations coordinated preparations ahead of public disclosure.
Once details become public, the pressure increases. Website operators need to establish whether they are exposed and get the appropriate fixes into place.
For business owners, the practical question is straightforward:
Has the provider responsible for your hosting checked your environment and applied the necessary PHP security updates?
Updating WordPress alone does not fix this
Keeping WordPress, themes and plugins updated is essential. However, these particular vulnerabilities affect PHP itself.
That means clicking “update plugins” in your dashboard does not resolve the underlying issue.
The necessary fixes must be applied to the PHP software running within the hosting environment. Depending on your setup, that responsibility may sit with your hosting provider, server administrator or technical support team.
This is why knowing who manages each part of your website matters. A website can look perfectly normal while still needing an urgent security update behind the scenes.
What this means for Madhouse hosting customers
For customers whose websites are hosted with Madhouse within our WP Engine managed hosting environment, the necessary PHP security updates have already been applied. No action is required from you for these hosting updates.
WP Engine has confirmed that additional protective measures were implemented across its network and servers before the official patches became available.
Its security teams have also been monitoring the situation and applying the latest security patches as they became available.
At Madhouse, we work with WP Engine to keep customers informed and ensure the websites we manage receive the relevant hosting updates.
These updates relate specifically to your website hosting environment. If your organisation uses other servers, internal applications or systems running PHP, your internal IT provider should assess those separately.
Cheap and cheerful is less cheerful when something goes wrong
A bargain hosting package can look attractive. A few pounds a month, somewhere to put your website, job done.
Until something needs urgent attention.
Then the questions start:
- Who monitors security announcements?
- Who applies updates to the server software?
- How quickly are critical vulnerabilities addressed?
- Are backups available, and can they actually be restored?
- Who investigates suspicious activity?
- Who can you speak to when you need a clear answer?
You are paying for the response as well as the space on a server.
Price alone does not prove whether hosting is secure. An expensive package still needs proper management, and a lower price does not automatically mean poor service.
However, if the main selling point is that it costs next to nothing, find out exactly what is included. Someone still needs to do the work.
What good website hosting and security should include
A properly managed website needs several layers of protection, with clear responsibility for maintaining them.
Prompt security updates
Your hosting provider should have a process for assessing vulnerabilities and applying relevant fixes to PHP and other server software.
Installing an update is part of the job. Checking that the fix is in place and the website still works matters too.
Monitoring and protective measures
Monitoring, access controls and appropriate firewall protection can help detect or reduce malicious activity.
These measures support security updates. They do not make patching optional.
Reliable backups and recovery
If something goes wrong, you need a workable recovery plan.
Ask how often backups are taken, how long they are retained, where they are stored and how restoration works. A backup is far more useful when someone knows how to recover your website from it.
Ongoing website maintenance
Hosting security and website maintenance need to work together.
WordPress, themes, plugins, user accounts and custom code all need attention. A patched server cannot make an abandoned plugin safe.
People who take responsibility
When a security alert lands in your inbox, you should be able to get a clear explanation of what it means for your website.
No jargon marathon. No guessing who is responsible. Just useful information and a plan where action is needed.
The real cost is what disruption does to your business
The monthly hosting bill is easy to compare. The cost of disruption is less predictable.
For an online shop, downtime can mean lost orders. For a service business, it can mean missed enquiries. A compromised website can also create recovery costs, staff disruption and difficult conversations with customers.
No provider can promise that a website will never face a security problem.
What you should expect is a service that takes prevention seriously, responds promptly and helps you recover when needed.
Saving pennies on hosting can become expensive if nobody is properly looking after it.
Not sure where your website stands? Let’s have a natter
You do not need to become a PHP expert to run your business. You do need to know who is looking after your website and what your hosting actually covers.
At Madhouse, we’re here to help you understand your setup, discuss your website hosting and security, and work out where improvements may be needed.
Whether you’re unsure if the latest fixes have been applied or you’ve outgrown a cheap hosting package, get in touch.
Let’s give your business website the attention it deserves.
