Critical PHP Vulnerabilities: What a Medical Practice Needs to Ask Whoever Built Its Website

On October 21, the PHP developers released emergency updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both can allow an attacker to run code on a server without logging in, and both are rated 9.2 out of 10. For a medical practice, the question is not whether it built its own website. The question is whether its website, hosting environment, or third-party applications run on affected PHP software, and whether those systems have been patched.