The internet is scrambling to patch a critical PHP flaw. If you’re hosted with WHC, you’re not.

A critical security vulnerability in PHP, the software that runs most of the websites on the internet, is making headlines across Canada and around the world.

If your website is hosted with WHC, here’s the short version: our team is already on it, and the large majority of our customers are protected.

Now the longer version, because you deserve to know what’s happening and what, if anything, you need to do.

What is PHP2Shell

On October 21, 2026, cybersecurity researchers disclosed two critical vulnerabilities in PHP, nicknamed “PHP2Shell.”

PHP is a programming language that works behind the scenes to make websites function, display content, and communicate with databases. Nearly 70% of websites worldwide use PHP, including most WordPress, Drupal, and Joomla sites.

That’s why this vulnerability is making so much noise.

In plain English: without a security patch, these vulnerabilities could allow hackers to run malicious code on an unprotected server. That's serious. It's why PHP released emergency security patches today, and why the story is making headlines.

The key words here are “unprotected server.” Once patched, that door is closed.

What WHC has done to keep you protected

As soon as the vulnerability was made public and a security patch became available, our team got to work applying it across our servers.

Good news: All servers managed by WHC are now protected.

This covers the vast majority of our clients. If you use our Web Hosting, WordPress Hosting, or Reseller Hosting services, or run on a VPS or Dedicated Server managed by WHC, there’s nothing you need to do. We’ve taken care of it for you.

This latest vulnerability (yes, another one!) is a reminder that cyber threats are becoming more frequent and more serious.

Fortunately, at WHC, we have a dedicated team keeping a close eye on things. Their job? Monitor threats, identify risks, and act quickly to keep our clients protected.

That’s part of what hosting with WHC means: having a team looking out for your hosting, even when it’s the last thing on your mind.

What you need to do

If WHC manages your hosting, you're protected and there's nothing you need to do. The security patch has already been applied.

There are, however, a few situations that may need your attention.

If you manage your own server, or if our team doesn't have access to it, we can't apply the patch for you. We recommend doing so as soon as possible.

You'll find instructions on the official PHP website.

Prefer to leave it to us? No problem! Just contact our team and provide access to your server. We'll be happy to take care of it for you.

What if your website uses an older version of PHP?

If your website hasn't been updated in a while, it's possible that the security patch could affect certain features or functionality.

Don't worry, the vast majority of websites continue to work normally. But if you notice anything unusual, reach out to us. Our team is here to help.

We’re keeping watch

That’s it, folks! You don’t need to follow the technical details or refresh a news site all day. That’s our job.

If you have a question, or you’re not sure which category your setup falls into, our team is here. Reach us via your Client Area or chat with us on our website.