What It Means for Your Website

It’s been one heck of a week here at Gambit Nash and across the technical industry!

You may have seen the recent news about critical security vulnerabilities affecting PHP, the technology that powers WordPress and many other websites.

At Gambit Nash, our team has been working late into the night to assess the issue and ensure the websites we host are secure.

Here’s what you need to know.

 

What is PHP, and what’s happened?

PHP is a programming language that powers a large proportion of the web (69.3% in fact! Working out to roughly 7/10 websites), including WordPress, WooCommerce and many bespoke websites.

On 21 October 2026, the PHP development team released security updates addressing two critical vulnerabilities. These flaws could allow attackers to run malicious code on affected servers without needing to log in.

In simple terms, websites running a vulnerable version of PHP could be at risk of being compromised, potentially putting website data, functionality and security at risk.

 

What is Gambit Nash doing?

We take website security seriously. Since the vulnerabilities were announced, our team has been working into the night to assess affected environments, apply the appropriate security updates and take steps to protect the websites under our care.

We’re prioritising the security of our hosting environments and the websites running on them, while taking compatibility and stability into account.

 

Do you need to do anything?

If your website is hosted and maintained by Gambit Nash (excellent choice by the way), we’re working to address the issue within the environments we manage.

If you host your website elsewhere, or manage your own server, we recommend contacting your hosting provider to confirm that the appropriate security updates have been applied.

The fixes are available in the following PHP releases:

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Older, unsupported PHP versions may require an upgrade to a supported release to receive the necessary protection.

 

Also this week – eMudhra CA Compromised 

Unrelated to the PHP vulnerabilities, A trusted certificate authority in India responsible for TLS/SSL security of many websites had 8 private keys compromised, with one key being as simple as the number “4”.  Gambit Nash doesn’t use eMudhra for TLS certificates, but those intermediate certificates were trusted by almost all modern devices and web browsers, as well as our servers.Our team also worked to remove the compromised intermediates from the trust stores of all of our systems ahead of official patches, ensuring the security of our systems and hosting environments.

 

 

We’re here to help

Security issues like this are a reminder of the importance of keeping website infrastructure up to date. While these vulnerabilities are serious, prompt action can significantly reduce the risk.

Your website’s security is our priority. We’ll continue to monitor the situation and take the necessary steps to protect the websites and hosting environments we manage.

If you have any concerns or questions about your website, please get in touch with the Gambit Nash team.

 

Is managing your website becoming a headache?

From security updates to ongoing maintenance, keeping a website running smoothly can be a lot to juggle. Let us take some of the stress off your shoulders.

Whether you’re looking for a new website, reliable hosting or ongoing support for your existing site, Gambit Nash is here to help you get on with what you do best.

Get in touch with our team to find out how we can help build, host and look after your website, leaving you with one less thing to worry about.