SEVNworks Start a project

Website owners (Security watch)

Published: 23 Oct 2026 · Last checked: 23 Oct 2026, 11:53am AEDT

Checked: 23 Oct 2026, including a publish-day check of CISA and the ACSC

Website owners: update PHP now to fix the "PHP2Shell" flaws

If the button does not work, use your browser's print command.

In short: Two serious flaws were found in PHP, the software behind WordPress and many other websites. Fixes are out, and security companies report attack attempts. If your site uses PHP, ask your web host or developer to update it now.

Think you've been scammed? Act now. It's not your fault.

  1. Lost money or shared bank details? Call your bank or card provider straight away and ask them to stop any transactions. Use the number on the back of your card or in your banking app.
  2. Report it to Scamwatch (scamwatch.gov.au/report-a-scam).
  3. Cybercrime (hacked account, stolen money or data, extortion)? Report it to police through ReportCyber (cyber.gov.au/submit-a-report).
  4. Your identity details have been misused or stolen? Call IDCARE free on 1800 595 160.
  5. Need urgent cyber help? Call ASD's Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371). It's open 24 hours a day, 7 days a week.
  6. Someone is in danger right now? Call 000.

Be careful of anyone who offers to get your money back for a fee. That is usually another scam.

What's happening

The PHP project released fixes for two critical security flaws on 21 October (early 22 October, Sydney time), in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, according to its security advisory. The flaws are CVE-2026-109618 and CVE-2026-109619, nicknamed "PHP2Shell".

  • They can let an attacker run their own code on a web server without logging in.
  • They can also expose sensitive server memory, which may hold passwords and keys.
  • Wiz Research, which helped find them, says versions back to PHP 5.4 are affected.
  • The flaws are in PHP itself, so updating a WordPress plugin or theme won't fix them.

Details leaked online before the fixes came out. Several security companies, including Cloudflare, watchTowr and Hadrian, say they've seen attempts to exploit the flaws.

When we last checked (23 Oct), the US cyber agency CISA said it had not observed exploitation, and the flaws weren't on its list of known exploited vulnerabilities. Australia's ACSC said it "is not aware of successful active exploitation within Australia". Security companies report a rising number of attack attempts, and one (ELLIO) says some now carry working malware, but none we found has reported a confirmed break-in. Patch as if attacks are under way.

Who's at risk

  • Websites that run on PHP. That includes every WordPress, Joomla and Drupal site, because they're built on PHP.
  • Sites on PHP 8.1 or older, which the PHP project no longer updates.
  • Sites that don't use PHP aren't affected. If you're not sure, ask whoever built or hosts your site.

What to do

  1. Email your web host or developer and ask: "Is my site's PHP updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or does it have your fix for PHP2Shell?"
  2. On WordPress, you can see your PHP version under Tools > Site Health > Info > Server.
  3. On PHP 8.1 or older, ask your host whether they've installed their own fix, and plan an upgrade. CISA advises that sites which can't be patched straight away be taken offline until they can.
  4. A web application firewall, such as Cloudflare's, can add protection while you patch. It doesn't replace the update.

Why it matters in Australia

ASD's Australian Cyber Security Centre (ACSC) issued a critical alert about these flaws on 21 October. If your site is on shared hosting, your host installs PHP and decides which versions you can use. Ask them to confirm your site is on a fixed version. Some hosts also let you switch PHP versions yourself in your hosting control panel.

Report it / get help

Sources

  1. PHP project, "Security advisory: Critical remote code execution vulnerabilities, update now" and the PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 release announcements, 21 Oct 2026 (the source for the fixed versions). https://www.php.net/archive/2026.php (checked 22 Oct 2026)
  2. CISA, "Critical Vulnerabilities in PHP Require Immediate Patching", 21 Oct 2026. https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching (checked 23 Oct 2026)
  3. CISA, "Known Exploited Vulnerabilities Catalog, version 2026.10.21". https://www.cisa.gov/known-exploited-vulnerabilities-catalog (JSON feed checked 23 Oct 2026, 11:52am AEDT; neither CVE is listed)
  4. ASD's ACSC, "Critical vulnerabilities in PHP", 21 Oct 2026. https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php (checked 23 Oct 2026; ACSC doesn't list fixed versions, so those are cited to source 1)
  5. Wiz Research, "PHP2Shell", 21 Oct 2026. https://www.wiz.io/blog/php2shell-php-rce (vendor research. checked 22 Oct 2026)
  6. Cloudflare, "Cloudflare deploys protections against php2shell vulnerability", 21 Oct 2026. https://blog.cloudflare.com/php-vulnerabilities-waf-protection/ (vendor. checked 22 Oct 2026)
  7. SecurityWeek, "PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors", 21 Oct 2026. https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/ (checked 22 Oct 2026)
  8. WordPress.org, "Critical PHP Security Release", 21 Oct 2026. https://wordpress.org/news/2026/10/critical-php-security-release/ (checked 22 Oct 2026)
  9. CERT-EU, "Security Advisory 2026-018, Critical Vulnerabilities in PHP", 21 Oct 2026. https://cert.europa.eu/publications/security-advisories/2026-018 (checked 22 Oct 2026)
  10. WordPress.org, "Update PHP". https://wordpress.org/support/update-php/ (hosts decide which PHP versions are available; WordPress is built on PHP. checked 22 Oct 2026)
  11. ELLIO Threat Research Lab, "PHP2Shell: attacks before the patch, and automation by nightfall", 21 Oct 2026, updated 22 Oct 2026 (vendor research). https://ellio.tech/en/blog/php2shell-what-we-observed-and-what-to-do/ (checked 23 Oct 2026)

General information only, not advice. Disclaimer · Spotted an error? Corrections policy · Written by SEVNworks, a Sydney studio that builds websites and AI workflows. · SEVN Works Pty Ltd, ABN 84 677 263 035 · Privacy policy