If your business has a website, there is a good chance it runs on PHP, and on 21 October 2026 the PHP project released fixes for two critical flaws that can let an attacker run code on your web server without logging in. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Updating WordPress or your plugins does not fix this, because the problem sits in PHP itself. Ask whoever hosts your site which PHP version it runs, and make sure it is updated this week.
What happened
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 on the CVSS v4.0 scale. They are remote code execution bugs, which means an attacker on the internet could potentially take control of a vulnerable web server.
Before the fix was released, the Australian Cyber Security Centre (ACSC) had issued a critical alert warning organisations to find where PHP is used in their environments and to watch for PHP's security release. The technical details reportedly leaked ahead of the official release, and there are reports of early attack attempts. Security researchers are still cautious about how many sites have actually been compromised, so treat this as urgent, not as a confirmed mass breach.
PHP's own advice is blunt: there are no complete workarounds, and updating is the only safe choice.
Why this matters for a small business
PHP quietly powers a huge share of the web. You may be affected if your business:
- Runs a WordPress, Joomla, Drupal or WooCommerce website
- Has a booking, quoting or customer portal built by a web developer years ago
- Hosts a website on a shared hosting plan, a VPS, or your own server
- Uses an older internal web application that nobody has looked at in a while
Because the flaws are in the PHP engine, it does not matter how well your website itself is maintained. A fully updated WordPress site on an unpatched PHP version is still exposed.
The version problem: PHP 8.1 and older
PHP 8.1 and earlier are end-of-life, so no fix is being released for them. If your site is running one of those versions, patching is not an option. The site needs to be moved to a supported PHP version, and that can break older plugins and custom code, so it is worth planning rather than flipping a switch on a Friday afternoon.
What to do this week
- Find out where PHP runs. List every website, portal and web application your business owns, including ones a former developer or agency set up.
- Check the PHP version. Your hosting control panel (cPanel, Plesk or similar) normally shows it. If you cannot find it, ask your host or your IT provider.
- Update to a fixed release. For managed hosting, ask the provider to confirm in writing that they have applied PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or later). Some Linux distributions backport fixes without changing the version number, so ask the provider to confirm the fix, not just the version.
- Test the site afterwards. Check forms, checkout, logins and booking tools still work.
- Look for signs of compromise. Unfamiliar files in your website folders, new admin users, sudden redirects, or hosting alerts about unusual traffic are all worth investigating.
- Make sure you have a recent backup taken before and after the update, stored somewhere the web server cannot overwrite.
Don't rely on a firewall alone
Cloudflare and other web application firewalls have rolled out rules to block known attack patterns, and that is a useful extra layer. It is not a substitute for patching, because attackers keep changing their methods. Think of it as a seatbelt while you fix the brakes.
Part of a bigger pattern
This follows the ACSC's earlier warning about attackers scanning websites for outdated software, which we covered in our post on CMS webshell attacks. Websites are one of the most commonly forgotten parts of a business's IT. They sit outside the office network, the person who built them has often moved on, and nobody is assigned to patch them.
If you have on-premises or hosted servers running web applications, our server management service covers patching and monitoring. For wider coverage across your devices, cloud and websites, see our managed IT services, and our free IT security advice page is a good starting point if you are not sure what you have.
Need a hand?
If you are not sure which PHP version your website runs, or who is responsible for updating it, get in touch or call us on (08) 9325 1196. We are a Perth-based team that has been looking after local businesses since 1997, and we can help you work out where you stand and get it patched.