The important part first
As you may have read in the news a couple of major security vulnerabilities were found in the PHP programming language that powers the most common content management systems in use today, including Joomla (and Wordpress).
Although it was only released an hour or so ago we knew this was coming and have already patched all our servers this evening with the updates for CVE-2026-109618 and CVE-2026-109619. If your website is hosted on our servers, rest assured that those server updates have been applied.
All Expression sites are unaffected by this PHP security issue.
We know security notices can be unsettling. They often arrive with unfamiliar reference numbers, technical language and little explanation of what you actually need to do. So this is a straightforward update: the server patches are in place, and customers do not need to install those patches themselves or be concerned about the stories in the press.
What has been updated?
This evening’s work concerns the software running on our servers. PHP is software used behind the scenes by many websites. Like other software, it needs security updates when issues are identified.
The two CVE references above identify the issues covered by this update. A CVE number is a standard reference for a reported security vulnerability. It helps people distinguish one issue from another and discuss the same problem without relying on vague descriptions.
You do not need to learn those numbers. We have included them so that, if you have received an alert or read a security notice elsewhere, you can see exactly which update this note addresses.
The distinction between a server update and a website update matters. Applying these server patches is work for us to handle on the hosting we manage. It is not something you need to find in your website’s editing tools.
What this means for your website
For websites hosted on our servers: the updates for both listed CVEs have been applied this evening.
For Expression customers: your sites are unaffected by this PHP security issue.
For websites hosted elsewhere: this confirmation does not cover another provider’s servers. Ask your hosting provider to confirm their position.
If you are unsure where your website is hosted, get in touch. There is no need to guess from an old invoice or try to interpret a technical warning on your own. We can help clarify which hosting arrangement applies to your site.
Do you need to do anything?
You do not need to apply these server patches yourself. That work has been completed across our servers.
Contact us if you receive anything unusual regarding your website. Scammers as usual will be trying to capitalise on the sensationalist nature of these flaws as they have reached the mainstream media. I imagine emails will start flooding out soon.
Be cautious about unexpected messages asking you to sign in, pay for an urgent fix or share account details.
As always we are super vigilant when it comes to looking after our servers.