9.00am AWST 22/10/2026
An update of two recently disclosed critical security vulnerabilities affecting PHP, a widely used technology that underpins many websites, web applications and content management systems, including WordPress, Drupal, Joomla and numerous custom-developed applications.
The vulnerabilities (CVE-2026-109618 and CVE-2026-109619) have been assigned a critical severity rating and may allow an attacker to remotely execute malicious code on vulnerable servers without needing valid credentials. Security researchers and vendors have reported early exploitation activity following public disclosure.
Who may be affected?
You may be impacted if your organisation operates:
- Public-facing websites
- Customer portals
- Intranets or web applications
- WordPress, Drupal, Joomla or similar platforms
- Custom applications running on PHP
What should you do?
If your website or applications are managed by an internal IT team, web developer, hosting provider or third-party support partner, we recommend contacting them as soon as possible to confirm:
- Whether any systems use PHP
- Whether affected versions are present
- Whether the latest security updates have been applied
- Whether there is any indication of suspicious activity or attempted exploitation
Patched Versions
The PHP project has released security updates to address these vulnerabilities:
- PHP 8.5 → 8.5.12
- PHP 8.4 → 8.4.27
- PHP 8.3 → 8.3.36
- PHP 8.2 → 8.2.35
PHP 8.1 and older versions are no longer supported and may remain vulnerable.
Why this matters
If exploited, these vulnerabilities could potentially allow attackers to:
- Take control of vulnerable web servers
- Access sensitive information
- Modify website content
- Deploy malware or web shells
- Disrupt business operations
While not every PHP-based website will be vulnerable, organisations should treat this as a high-priority security update and validate their exposure as soon as possible.
How we can help
If you would like assistance assessing potential exposure, validating patch status, or understanding any information provided by your hosting or support provider, please contact our team.
We will continue monitoring industry guidance and threat intelligence and will provide additional updates should material developments occur.
3.00pm AWST 21/10/2026
The federal government’s Australian Signals Directorate (ASD) has just posted an alert for two critical PHP vulnerabilities. This may affect your website and website applications.
We recommend contacting your website developer or hosting company as soon as possible, and getting them to follow the ASD’s mitigation advice.
The ASD’s Australian Cyber Security Centre advises individuals and organisations to:
- Identify PHP within their environments.
- Monitor and review PHP official guidance at PHP Security Release.
- Prepare to update and apply security patches as they become available.
- Monitor PHP applications and associated environments for potentially malicious activity.
Taking action early will help keep your business protected.
12.15pm AWST 22/10/2026
Check your suppliers with our PHP2Shell checker
Patching your own website is step one. But you should also check the businesses you work with.
Your suppliers, partners and service providers often have access to your data, systems or customers. If their website is vulnerable, your business could be exposed too. This is known as supply chain or third-party risk, and attackers rely on it.
To help, we’ve put together a free PHP2Shell checker. Enter a website address and it will tell you which version of PHP that site appears to be running, and whether that version includes the security fixes.
Reminder
The checker is a helpful first step, not a guarantee. Websites can hide or change the details they share, and some hosting providers apply fixes without changing the version number. If a result is unclear or concerning, the best move is to ask the supplier directly. Something like this works: “Have you applied the latest PHP security updates to your website and systems?”