The short answer: on 21 October 2026, PHP released an emergency update for two critical flaws that let attackers take control of a web server without a password. If your business runs a website, online store or web portal, it very likely uses PHP and needs this update.
The flaws, CVE-2026-109618 and CVE-2026-109619 (nicknamed "php2shell"), are both rated 9.2 out of 10. Details leaked the day before the fix, and attacks were reported before the patch was available.
What is PHP?
PHP is the behind-the-scenes language that powers a large share of the web, including WordPress, WooCommerce, Magento and many booking systems and portals. Think of it as the engine under the bonnet of your website. These flaws are in the engine itself, so updating WordPress or plugins will not fix them; WordPress.org confirms the PHP update is the only fix.
What the flaws do
Both allow remote code execution: an attacker sends a crafted request to your site and makes the server run their commands. No login or user click is required. Every PHP version from 5.4 to 8.5.11 is affected.
- PHP 8.5: fixed in 8.5.12
- PHP 8.4: fixed in 8.4.27
- PHP 8.3: fixed in 8.3.36
- PHP 8.2: fixed in 8.2.35
- PHP 8.1 and older: no official fix, because these versions are end of life
Why it matters
A compromised web server can lead to stolen customer data, a hijacked or blacklisted website, hidden back doors and a path into your wider network. If personal information is exposed, you may also have obligations under the Notifiable Data Breaches scheme.
Three things make this one urgent: attackers had working exploits before the patch, it affects almost every PHP site, and older PHP versions (8.1 and below) will stay vulnerable unless upgraded or patched by your host.
What to do now
- Ask your host or web developer today: "Have you applied the 21 October 2026 PHP security release to our site?" Get the answer in writing. Most managed and shared hosts patch this for you; self-managed servers need someone to act now.
- Check your PHP version. In WordPress, go to Tools, Site Health, Info, Server. If it is 8.1 or older, plan an upgrade to 8.2 or newer (ideally 8.4 or 8.5), tested on a staging copy first.
- Ask for a compromise check. Since attacks started before the fix, have someone look for unexpected files, new admin accounts or unusual activity since 20 October.
- Add a web application firewall such as Cloudflare, which has deployed rules for these attacks. It is a useful extra layer, not a replacement for patching.
How we help
Not sure who hosts your website or whether it has been patched? We can find every PHP system in your environment, confirm patch status, apply updates, plan safe upgrades and check for signs of compromise. Contact our Perth or Melbourne team for help.
Information current as at 22 October 2026.
Sources: Laravel Forge, Codeable, Google Cloud, Huntress, Brandefense