Important website security update: what you need to know about PHP

As of Wednesday 21st October 2026, a critical security issue has been discovered affecting PHP, the technology that helps many websites, including WordPress and Laravel sites, run properly.

This is a global issue affecting websites around the world. It’s not specific to Ultimate or any individual website, but it’s important that the necessary steps are taken to protect affected sites.

What is the security issue?

In simple terms, a weakness has been found in PHP that could make some websites vulnerable to hacking. This means attackers could potentially exploit the weakness to gain unauthorised access to affected servers.

Security fixes have been released by the PHP development team, and it’s important that affected websites are updated as soon as possible.

What does this mean for your website?

The discovery of this vulnerability does not mean your website has been hacked.

However, as this issue affects the underlying technology used by many websites worldwide, it’s important that website owners and providers act quickly to apply the necessary security updates.

What are we doing about it?

We’re treating this as a matter of urgency and are working through the websites we manage to apply the necessary security patches and carry out the relevant checks.

Security patches began being released by the PHP development team at 3pm on 21 October, with updates becoming available gradually. We’re applying the relevant fixes as soon as they’re available and can be safely implemented.

We’ll keep our clients informed of any updates specific to their websites. Unless we contact you directly, there’s nothing you need to do at this stage.

Have questions about your website?

We understand that security issues can be worrying, but please be assured that we’re taking this seriously and working quickly to protect the websites we look after.

If you have any questions or concerns, please get in touch with our team. We’re happy to help.

The Ultimate team