This week, the group that maintains PHP released fixes for two critical security flaws, tracked as CVE-2026-109618 and CVE-2026-109619. PHP is the software behind most websites, including every WordPress site. If your practice has a website, an appointment request form, or a patient portal, it is worth a quick question to whoever runs it.
What Happened
The flaws could allow an attacker to run their own code on a web server. Early attacks have been reported, though that is not yet confirmed. Fixes are available, but a website only benefits once whoever hosts it has installed them.
Why It Matters for a Healthcare Practice
Many practice websites collect information through contact forms, appointment requests, or intake pages. If an attacker gains control of the server behind a site like that, anything stored or submitted there is at risk. When that includes patient information, a server compromise can quickly become a compliance matter as well as a technical one.
You do not need to understand the technical details. You need a clear “yes, it is done” from the right person.
The Question to Ask
Ask whoever hosts or maintains your website, whether that is your hosting company, your web designer, or your IT provider:
“Does the PHP version on our website include the fix for CVE-2026-109618 and CVE-2026-109619?”
A good answer is a clear yes, with a date. A vague answer, or no answer, is worth following up on. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and older will not receive a fix, so a site still running one of those needs to be upgraded rather than patched. Some hosts also protect sites in other ways, such as blocking known attack patterns, which is why asking matters more than guessing from a version number.
What About Our Clients?
We’ve reviewed our clients’ websites and have ensured they have been patched or otherwise mitigated as needed.
Not Sure Who Looks After Your Website?
If your practice does not have someone handling this, we can contact your host, get written confirmation of the patch status, and manage ongoing updates if you would like that.