The PHP security flaw: is your website affected?
On 21 October 2026 the PHP project released emergency fixes for two critical flaws, nicknamed PHP2Shell. PHP is the software that WordPress, Joomla, Drupal and millions of other websites run on. Australian government websites, including cyber.gov.au, went offline as a precaution.
The short answer: whether your site is exposed depends on whether your web host has installed the fix. Below is what happened, how to find out where you stand, and what we do if you want it checked for you.
We confirm the scope and price before any work starts. Updated 23 October 2026.
What happened, in plain words.
PHP runs quietly behind a large share of the world’s websites. You never see it, but if your site is built on WordPress, Joomla or Drupal, it depends on it.
The two flaws, CVE-2026-109618 and CVE-2026-109619, can let a stranger run code on the server a website lives on, without a password. Both are rated 9.2 out of 10. Details became public before the fix was ready, so PHP brought its release forward to 21 October.
The Australian Cyber Security Centre issued a critical alert. ABC News reported that Australians face a spike in data breaches as a result. Security firms disagree on how widely the flaws are being exploited so far, so treat “attacks have been seen” as likely, not as a count of hacked sites.
How it unfolded.
- 20 OctoberDetails leaked ahead of the planned release.
- 21 OctoberPHP shipped fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The ACSC issued a critical alert. Cloudflare reported attack traffic that morning.
- 21 to 22 OctoberAustralian government websites, including cyber.gov.au, were taken offline while risks were mitigated. Major hosts began patching.
- NowPatching is uneven. Large platforms moved first. Smaller and self-managed servers are the long tail.
Is my website affected?
It depends on where your site is hosted and who keeps the server updated.
WordPress, Joomla or Drupal
Affected through PHP. Updating the platform or its plugins does not fix it. The server needs the PHP update.
Custom PHP site
Same answer. If it runs on PHP, the fix is a server update.
Shared or managed hosting
Your host installs the fix. Hosts work at different speeds, so ask them.
Your own server or VPS
You, or whoever runs it, must update PHP.
Squarespace, Wix, Shopify
These companies look after their own servers, so this is generally not something you install.
What to do today.
- Ask your host, in writingHas PHP been updated to a fixed version? Keep the reply.
- Find your PHP versionIn WordPress, go to Tools, then Site Health, then Info, then Server. Otherwise ask your host or developer.
- Check you are on a fixed versionPHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you are on 8.1 or older, ask whether the host has backported the fix or plan a move.
- Keep everything else updatedIt will not fix this flaw, but old plugins and themes are still where most sites get broken into.
- Look for anything unexpectedNew admin users, unfamiliar files or strange redirects. Make sure you have a backup you can restore.
Not sure how to do any of this, or want it done properly? That is what the Website Safety Check is for.
The Website Safety Check.
We look at your website from the outside, the same way anyone on the internet can. Then we tell you what we found, in plain English.
What your site runs on
The platform and, where it can be seen, the version. WordPress, Joomla, Drupal or something else.
Whether it looks up to date
Signs that the October fix and other updates have been installed, or that they have not.
Anything old or risky
Outdated add-ons, old software and warning signs anyone can spot from outside.
A clear recommendation
Leave it, fix it or replace it. With the reason, and who should do the work.
You get a short written report you can forward to your manager, your board, your IT person or your web host. We confirm the scope and price in writing before any work starts.
No logins or passwords needed for the outside check. Nothing for your IT team to set up.
Who this is for.
A good fit if
- Your website matters to your organisation and you are not sure who keeps it updated.
- It runs on WordPress, Joomla, Drupal or was custom built some years ago.
- You need a straight answer for a board, a manager or an insurer.
- You are a housing provider, professional services firm, healthcare group, association or a business with several sites.
Probably not for you if
- Your IT team or web host has already confirmed in writing that your server is updated.
- Your site is on Squarespace, Wix or Shopify.
- You want a promise that your site can never be hacked. Nobody can honestly give you that.
Installing the fix is a job for your host. Whether to keep the website is your decision.
Some websites are in good shape and need one update. Others carry years of add-ons that nobody looks after any more. The check tells you which one you have, so you can decide on facts.
If the answer is fix it or replace it.
You can take the report to your current web provider and have them do the work. Or we can do it for you.
If replacing makes more sense, we build a custom-coded website. It has no plugins for attackers to scan and no public login page that every bot already knows. It still needs updates, so we look after it with website management.
We move your content across and point every old page address to its new page, so people and search engines still find you. More on our website services, website redesign and why we build custom-coded sites.
Questions.
What is PHP2Shell?
PHP2Shell is the nickname for two critical flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10. They can let an outsider run code on a web server without logging in. PHP released fixes on 21 October 2026.
Is my WordPress site affected by the PHP vulnerability?
It can be. WordPress, Joomla and Drupal run on PHP, so the flaw sits in the software underneath them. Whether your site is exposed depends on whether your web host has installed the fixed PHP version.
Does updating WordPress fix the PHP flaw?
No. WordPress.org has said no WordPress update is required for these issues. The fix is a PHP update on the server, which your host or server administrator has to install.
Which PHP versions have the fix?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Versions 5.4 through 8.5.11 are affected. PHP 8.1 and older no longer receive official releases, so the host has to backport the fix or move the site to a supported version.
My site runs on PHP 8.1 or older. What now?
Ask your host in writing whether they have backported the fix. If they have not, plan to move to a supported PHP version. If the site cannot run on a newer version, that is usually a sign it is time to rebuild it.
Has my website already been hacked?
Nobody can tell that for certain from the outside, and nobody can honestly promise a site has not been touched. Reports of attacks since 21 October vary between security firms. The Website Safety Check looks for warning signs that can be seen publicly and says plainly if something looks wrong.
What does the Website Safety Check cost?
It depends on the size and complexity of the site. We confirm the scope and the price in writing before any work starts.
Do you need logins or access to our website?
Not for the outside check. It only looks at what anyone can see from the internet. For a deeper review we would ask for read-only access, agreed with you and your IT contact first.
Do we have to move off WordPress?
No. Many sites are fine once the server is updated and old add-ons are cleaned up. The report says plainly whether keeping your current platform makes sense.
What happens to our Google rankings if we rebuild?
We point every old page address to its new page and carry across titles, headings and content. We check the new site against the old one before it goes live.
Sources.
Last updated 23 October 2026. This page will change as patching and exploitation reports develop.
Find out where your website stands.
Request a free 30-minute conversation. Tell us about your website and we will recommend a useful next step. We confirm scope and price before any work starts.
Request a website check