Learn · October 26, 2026
Your Website Can Be Turned Into a Weapon — and It's Your Name on It
A compromised contractor website can damage customer trust. Learn what to ask your web company about PHP security, updates, monitoring, and recovery.
By The Catalyst Editorial Team Operator education · 7 min read
You spent twenty years building a name in your town. A customer types it into their browser, lands on your website, and trusts what happens next.
That trust comes from the work. Your techs show up when promised. Your office answers the phone. Your customers recommend you because you explain the options and stand behind the job. Whether you plan to pass the business to your kids or eventually sell it, that reputation is part of what makes the company valuable.
A compromised website can put those relationships at risk. Someone else can change what customers see, where they are sent, or what they are asked to submit, while your company name remains on the page.
Protecting your reputation includes knowing who is responsible for the security of your website and how they prove the work is being done. You can delegate the technical work. As the owner, you still need clear answers about the asset carrying your name.
That was the ownership issue behind the October 22, 2026 conversation with Jennifer Bagley and CI Web Group CTO Chris Heney about a critical PHP security warning. The immediate concern was a software vulnerability. The larger question was how many owners could confirm whether their websites were protected.
What the PHP warning means for your business
On October 21, CISA urged organizations to address two critical PHP vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. PHP is the server software used by WordPress and other website platforms. The vulnerabilities can allow an unauthenticated attacker to execute code on an affected server, meaning an attacker may be able to make the server run instructions without first logging in.
CISA directed organizations to identify affected systems and apply the updates immediately. For organizations unable to update, it recommended taking affected PHP systems offline until they could be patched or upgraded. Its notice also said a web application firewall may provide some protection while updates are being completed.
For a contractor, the practical question is straightforward: Does your website use affected software, and has your provider installed and verified the required fixes?
WordPress ownership alone does not tell you the answer. Your hosting environment, exact PHP version, and installed security updates matter. Updating WordPress, a theme, or a plugin does not by itself confirm that the underlying PHP software has been updated.
Your provider should be able to explain the status of each layer in plain language.
An update needs a plan and a verified result
The PHP project released fixes for supported branches. Its advisory also explains that PHP 8.1 and older no longer receive normal project updates, although some distribution and long-term-support vendors provide backported fixes. Limited source backports are also available for certain older releases.
That makes “there is no patch for anything older” too broad. It also makes “we're on an older version, but we're probably fine” an inadequate answer. An owner needs confirmation of the specific fix installed, who supplies it, and whether the environment remains supported.
The longer-term objective is a supported environment with someone accountable for keeping it current.
Older plugins, themes, or custom features may need work before a PHP upgrade. That does not automatically mean your website must be rebuilt. It means your provider needs to assess compatibility, back up the site, test the change, and prepare a recovery plan.
A successful update should include testing the parts of the website that generate business: contact forms, scheduling tools, payment links, and other customer actions. A homepage that loads is only one part of the check.
The same standard applies to firewall protection. Ask what it protects against, what remains exposed, and when the underlying update will be completed. A temporary protective measure needs a defined next step.
Your customers experience the problem through your name
A homeowner does not know which company hosts your website or maintains its software. They know the business they called when the air conditioner failed or the water heater leaked.
If a compromised website sends them to an unfamiliar payment page, displays a fake verification prompt, or publishes content your company never approved, they will associate that experience with you. Even customers who recognize the intrusion may hesitate before submitting a form or clicking another link.
Those are possible consequences of website compromise, not a claim that every affected site has experienced them. The point is that the damage can reach beyond the website itself. Your office may have to field concerned calls, help customers verify legitimate communications, and explain what happened.
For an owner thinking about succession or an eventual sale, this deserves attention alongside the other systems that keep the business dependable. Can someone identify who controls the website? Are access credentials managed? Is there a maintenance record? Could the company respond if the current provider became unavailable?
Those questions matter even when there is no emergency. They determine how much control the business actually has over an asset customers rely on.
Warning signs that deserve an immediate response
Ask your provider to investigate promptly if you or your customers notice:
- Unexpected redirects to unrelated websites or unfamiliar payment pages.
- New verification prompts, download requests, or browser security warnings.
- Blog posts or pages your company did not publish.
- Unexplained changes to forms, contact information, or payment instructions.
These signs do not identify a specific vulnerability on their own. They are reasons to investigate. Their absence does not prove a site is secure, either.
If a customer reports something unusual, record the page address, time, and what they saw. Share that information with your provider without asking the customer to revisit the page or interact with the suspicious content.
Your response plan should already name the person who investigates, the person who can restrict access, and the person who communicates with customers if needed. Discovering those responsibilities during an incident wastes time.
Five questions to send your web company today
Ask for written answers. You should be able to keep a clear record of the site's status and the work required.
1. What exact PHP version is running, and are the required security fixes installed?
Request the full version number, the relevant security update or vendor package, and confirmation of when it was installed and verified. If your site does not use PHP, ask your provider to confirm that and explain which platform they maintain instead.
“Everything is current” should come with enough detail to support the answer.
2. Who is responsible for updates, and how do you verify completion?
Hosting companies, website agencies, and software vendors may each handle different parts of the system. Ask who maintains PHP, WordPress, themes, plugins, and custom integrations, where applicable.
You need to know who closes the request and confirms that the affected systems have been checked.
3. What is the backup, testing, and recovery plan?
Ask when the last usable backup was created, whether restoration has been tested, and how the provider checks compatibility before an upgrade. Find out how they will verify forms, booking tools, and other essential functions afterward.
A backup is useful only if your team can restore it when needed.
4. Who monitors the site, and what happens when something looks wrong?
Ask what monitoring is included, who receives alerts, and how you report a suspected incident outside normal business hours. Clarify how the provider investigates unauthorized changes and determines whether further cleanup is necessary.
Installing a security update and investigating a suspected compromise are separate tasks. You need an answer for both.
5. Who can restrict access or take the site offline if necessary?
Confirm who has the authority and access to act, how quickly they can respond, and how customers will find accurate contact information during an interruption. Keep that process somewhere your team can reach without relying on the website itself.
Separately, ask your insurance broker what your cyber coverage includes and what notification requirements apply. Your web provider can describe its services; your insurer needs to explain your policy.
Make website accountability part of running the company
Start by sending those questions to your provider and assigning someone inside your business to collect the answers. If work is required, ask for an owner, a completion date, and confirmation when it is finished. If the provider identifies an immediate exposure that cannot be corrected promptly, agree on the protective action needed while the fix is completed.
Then establish how future maintenance will be reported. Keep a record of updates, access ownership, backups, and incident contacts so this information remains available when employees or vendors change.
You do not need to learn server administration to make this happen. You need a standard: the person responsible for your website can explain its condition, document the work, and respond when something goes wrong.
You earned customer trust through years of reliable service. Give the website carrying your name the same level of attention.
Watch the full conversation: WordPress Security Warning: Is Your Website at Risk?, recorded October 22, 2026, with Jennifer Bagley and Chris Heney.
