Last week, two critical flaws in PHP put a large share of the internet at risk. LenderHomePage clients were protected before most of the world finished reading the headlines, and none of them had to lift a finger.

Several clients asked us what happened. We want every client to have the same answer, so this post walks through the event, what our team did hour by hour, and what it means for anyone weighing a do-it-yourself or AI-built website against a managed one.

What happened

On October 20, 2026, the PHP security team gave the world one day's notice: a fix for two critical flaws would ship the next morning. (PHP announcement)

PHP is the programming language behind a large share of the web, including WordPress and many mortgage websites. The two flaws, now known as CVE-2026-109618 and CVE-2026-109619, let an attacker run their own code on the server that hosts a website. No password or login was required. The PHP team said every PHP installation that serves web pages was at risk. (PHP security advisory)

In plain terms: an unpatched site could be taken over by a stranger sending ordinary-looking web traffic.

How serious was it?

Both flaws scored 9.2 out of 10 on CVSS, the industry-standard severity scale. Anything 9.0 or higher is rated Critical, the top of the scale. The PHP team told all users they were strongly encouraged to update immediately.

Governments around the world sent the same message within hours:

• United States. The FBI and the NSA urged organizations to update at once. Both recommended that anyone who could not update take their systems offline until they could. (BGR)
• European Union. The European Commission, ENISA, CERT-EU and Europol issued a joint statement telling organizations to apply the updates immediately. (ENISA)
• Japan. Prime Minister Sanae Takaichi posted on X with an urgent request for everyone to "take action tonight." She later took her own website offline as a precaution. (OfficeChai, Jiji Press)

When a head of government asks the public to act on a software update, the risk is real. Across Japan and Europe, banks, ticketing platforms and government agencies chose to shut their own websites down rather than run them unpatched.

What our team did

Our engineers reduced the risk the night of the warning, before a fix existed, and had every client site on the fixed version the same day it shipped.

You did not have to do anything. You had no plugin to update, no server to patch and no developer to call.

The problem with vibe-coded websites

Today, anyone can describe a website to an AI tool and have one running by the end of the afternoon. People call this "vibe coding." It is fast, cheap and impressive. Building the site is the easy part.

The hard part starts after launch, and last week showed exactly what it looks like:

• Who watches for security alerts? The warning went out on a Tuesday. An AI tool does not read advisories, and it will not text you when one affects your site.
• Who knows what your site runs on? If your site was generated by an AI tool, could you say whether it runs on PHP, which version, or where it is hosted? You cannot patch what you do not know you have.
• Who applies the fix at 7:00 a.m. on a Wednesday? The fix landed early on a workday morning. Every hour an unpatched site stayed online, it was exposed.
• Who tests that the fix does not break your application forms? A rushed update that breaks your lead capture costs you borrowers. A careful one takes people who know your setup.
• Who decides whether to take the site offline? The FBI and NSA said to go offline if you could not patch. Someone has to make that call, and fast.

AI-generated code can also carry its own weaknesses, because the person shipping it often cannot review it. And the same AI tools that make sites easy to build make flaws easier to find: these PHP bugs went unnoticed for more than ten years until AI-assisted security teams spotted them. (NewsBytes) Attackers have the same tools.

A vibe-coded site is not automatically insecure. The risk is that nobody is responsible for it. When the next critical alert lands, a site without an owner simply stays exposed.

This is not a one-time event

Security flaws are being found faster than ever, and 2026 is already the largest year on record.

• 2015: about 6,500 flaws were published worldwide.
• 2025: about 48,000 were published.
• 2026: more than 81,000 by October 20, already about 1.7 times the total for all of 2025. (DeXpose CVE 2026 tracker)

Most of those will never touch your website. A few will, and some will be as serious as last week's. Our team monitors these alerts every day, and we act on the ones that affect your website as quickly as we can.

Why this matters for mortgage companies

Your website and lead forms collect borrowers' personal and financial information. A flaw like this one is not a theoretical risk for you. It is a direct risk to your borrowers, your reputation and your compliance posture.

A lender's website is not a brochure. It holds names, phone numbers, income details and loan scenarios, and regulators expect you to protect that data. "We built it ourselves with an AI tool" will not be a comfortable answer to give an examiner after a breach.

LenderHomePage is SOC 2 Type II compliant. An independent auditor reviews how we monitor, patch and protect the systems that hold your data, and confirms we do it consistently over time. That is the difference between a website and a website that someone is responsible for.

The bottom line

Last week, a critical flaw put a large share of the web at risk overnight. LHP clients slept through it, because our team did not.

If you are an LHP client, there is nothing you need to do. If you have questions about last week's event or how we protect your site, contact your account manager. And if a colleague is weighing a do-it-yourself or AI-built site, send them this post. The question to ask is not "how fast can we build it?" but "who is responsible for it the morning after?"

Sources

• PHP: Upcoming Critical PHP Security Release (Oct 20, 2026)
• PHP: Security advisory, critical remote code execution vulnerabilities (Oct 21, 2026)
• ENISA: Joint statement on critical PHP vulnerabilities
• BGR: FBI issues warning on major cybersecurity threat
• OfficeChai: Japan's Prime Minister, USA's FBI take to X over the PHP vulnerability
• Jiji Press via Nippon.com: Japan government issues rare calls over PHP flaw
• DeXpose: CVE 2026 tracker