A repair shop's booking page can work all morning while the software underneath it needs an urgent security fix. Customers see a working page. The owner may have no reason to open the hosting dashboard.

That gap matters. Two security warnings in October 2026 show why keeping a business online includes maintaining parts of its technology that customers never see.

Two warnings beneath the surface

The first concerns eMudhra, a company that issues digital certificates. Certificates help software check that it is talking to the real website or service.

Mozilla reported on October 20 that private keys for eight eMudhra intermediate certificates had been compromised. An attacker able to intercept a connection could use fraudulent certificates to impersonate a website and potentially read or change its traffic. Mozilla distributed blocks to Firefox and announced further software updates.

The risk extended to people visiting websites whose own certificates came from another company: vulnerable software could still trust a forged certificate. Checking which company issued your website's certificate therefore answers only part of the maintenance question.

The second warning concerns PHP, software used to run websites and web applications. On October 20, the PHP security team announced two critical vulnerabilities, with a security release scheduled for October 21 at 14:00 UTC, or 10 a.m. Eastern. It urged users to prepare to upgrade when the fixes became available.

CERT-EU's advisory described a potential remote code execution risk: an attacker could cause a vulnerable server to run instructions remotely. At the time of writing on October 21, PHP's official notice had not yet published the full technical details or affected and fixed versions. Owners should follow the linked notices for that information rather than assume every PHP website is affected in the same way.

Neither warning establishes that your business has been attacked. Both give the person maintaining your systems a reason to check promptly.

Give maintenance a named owner

When a developer finishes a website, the handover should identify who maintains it afterward. Paying for hosting may cover the server while leaving application updates to someone else. Ask what your particular agreement includes.

Start with the systems you rely on to take orders, book appointments and communicate with customers. For each, record the provider, the account owner and the person responsible for updates. Include the domain and hosting accounts so you can reach the right company during a problem.

You can ask a provider:

  • Which parts do you maintain, and which are our responsibility?
  • How do you find out about urgent security advisories?
  • Does our current software still receive security fixes?
  • How will you confirm that an update is running successfully?

A subscription label such as “managed hosting” is less useful than clear answers to those questions.

Make updates a routine, with a route for urgent fixes

CISA recommends installing software updates promptly and enabling automatic updates where available. For staff devices and browsers, that can reduce the chance of a fix sitting unnoticed. Complete any restart the update requires.

A custom website or business app also needs a maintenance plan. Ask its maintainer to assess an urgent advisory against the software actually in use. Some updates will fit a planned maintenance window; a critical flaw in an exposed service may need action sooner.

Before changing a business system, confirm there is a recent backup and a workable recovery plan. For larger changes, a separate test copy can help reveal compatibility problems before customers encounter them. These preparations should make urgent work easier to carry out.

Afterward, test what earns the business its money. Place a clearly marked test order, submit an inquiry or complete a booking. Check that the confirmation reaches the right inbox. A successful installation message does not establish that every part of the customer journey still works.

Ask for a short record of the work

Keep a note of what changed, when it was applied, what was checked and who to contact if something stops working. If a system can no longer receive security fixes, ask for a replacement or migration plan.

For the October warnings, a useful message to your provider would be:

“Could you check whether our systems need changes for the eMudhra certificate incident or the PHP security release, apply the relevant fixes, and confirm that ordering and inquiries still work?”

You do not need to become a security specialist to ask that question. You need someone responsible for answering it.