PHP2Shell: Is Your Business Website Patched Against the New PHP Flaws?
If your business website runs on WordPress, it runs on PHP. On 21 October 2026 the PHP project fixed two critical flaws in PHP itself, now known as PHP2Shell, and the Australian Signals Directorate put out a critical alert the same day.
If your site is on ordinary shared hosting, your host has most likely patched it already without you lifting a finger. "Most likely" is not "definitely", though, and attackers were probing for these flaws before the fix existed. It is worth ten minutes this week to confirm your site is covered.
What PHP2Shell is
PHP is the programming language that sits on the web server and builds your pages when someone visits. According to W3Techs, it runs 69.2% of websites where the server language is known. WordPress alone, which is built on PHP, runs 39.6% of all websites. Joomla, Drupal, WooCommerce shops and plenty of custom-built business sites use it too.
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and both are rated 9.2 out of 10. In the PHP project's security advisory, they "can allow unauthenticated remote code execution". In plain English, someone on the internet can send your web server a specially crafted request and run their own code on it, without logging in to anything.
The PHP team says the risk is highest on servers using mod_php, "with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs." That last part matters. A well-kept WordPress site is no safer here, because the attack happens before WordPress even starts.
That also means updating WordPress, your theme or your plugins does not fix this. The fix has to go on the server, in PHP itself. On most small business websites, that is your hosting company's job.
The flaws were found by researchers at Calif, OpenAI and Wiz. If you want the technical detail, Wiz has a breakdown:
Attackers were already testing it
The fixed PHP versions came out at 14:00 UTC on 21 October, which was 10pm AWST that Wednesday. Attackers were not waiting.
Amazon Threat Intelligence says its decoy servers recorded a PHP2Shell exploit attempt on 17 October, four days before the flaws were public. More attempts from several different sources followed between 10am and 4pm AWST on the 21st, before the fix was out, and Amazon says "PHP2Shell is now seeing broad exploitation attempts in the wild."
The good news is that the big hosts saw it coming. WP Engine says its firewall blocked more than one million requests linked to these flaws in 24 hours, with no successful attacks seen. Attempts are not the same as break-ins, but a server that still has the old PHP on it is now a target.
ASD's Australian Cyber Security Centre issued a critical alert and told organisations to identify where they use PHP, apply the updates and watch for suspicious activity:
Australian Signals Directorate@ASDGovAuView on X❗ ALERT UPDATE ❗ Patches are now available for two critical PHP vulnerabilities. If your organisation uses PHP, we recommend identifying affected systems, reviewing official PHP guidance and applying appropriate mitigations as soon as possible 👉 cyber.gov.au/alert/critical…
Who needs to do something
Where your website lives decides how much of this is your problem.
Shared hosting with cPanel (VentraIP, Crazy Domains and similar). Your host manages PHP for you, and the big Australian hosts have patched. VentraIP's status page says the fixes were applied across its shared hosting and fully managed servers on 22 October, with no action needed from customers. Crazy Domains finished patching its shared Linux hosting by 23 October.
Managed WordPress hosting (WP Engine, Kinsta, SiteGround and the like). Same story. These hosts patched at the platform level and have published notices saying customers do not need to do anything.
A VPS or your own server. This is the group that needs to act. If your developer set up a virtual server for you, or your site runs on a box in the office, nobody patches PHP unless someone logs in and does it. Hostinger, for example, has told its VPS customers to update and restart PHP themselves.
Wix, Squarespace or Shopify. These platforms run their own servers and you have no PHP to update. Nothing to do here.
Very old PHP versions. The PHP project only updates versions 8.2 and newer. Version 8.1 and older no longer get official fixes, although the PHP team released stopgap patches for 7.4, 8.0 and 8.1 this time, and some hosts get backported fixes from their software vendors. W3Techs data shows about a third of PHP websites are still on version 7 or older. If yours is one of them, this is a good push to get it upgraded, because the next flaw may not get the same special treatment.
Check your website in ten minutes
1. Work out who hosts your site. Check your hosting invoice or renewal email, or ask whoever built the site. Your domain registrar and your host are often the same company, but not always.
2. Look at your host's status page or recent emails. The big hosts posted notices about these flaws between 21 and 23 October. If yours says the patch is done and no action is needed, you are in good shape.
3. Check your PHP version. In WordPress, go to Tools, Site Health, Info, then open the Server section. In cPanel, look for MultiPHP Manager or Select PHP Version. The fixed releases from the PHP project are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
4. Do not panic if the number looks lower. Many Australian shared hosts use CloudLinux, which adds the fix to the existing version without changing the number. VentraIP gives the example that its patched PHP 8.4 shows as 8.4.26, not 8.4.27, and Crazy Domains says the same about 8.2.34. If the number does not match, ask your host rather than guessing.
5. If you are on a VPS or nobody can confirm it, ask in writing. Something like: "Has the PHP on our website server been updated for CVE-2026-109618 and CVE-2026-109619 (PHP2Shell)? If so, when?" A good host or developer will answer that in one line.
If you cannot get an answer and the site is on a server nobody is looking after, business.gov.au's advice is blunt: consider taking the website offline until it is patched. Losing a few days of enquiries is cheaper than cleaning up a hacked server.
Upload problems on your site this week?
Some hosts put temporary limits in place while they waited for the patches. Crazy Domains warned these could affect uploading larger images and documents, submitting larger forms, importing data and restoring backups, and said the limits would stay on until it was safe to remove them. VentraIP has already lifted its temporary upload restrictions.
So if your contact form, online quote form or media uploads have been playing up since 21 October, this is a likely reason. Check your host's notice before assuming your website is broken.
Signs your site may have been hit
Amazon's advice is to start any investigation from 17 October, not from the day the flaws were announced. For a small business website, keep an eye out for:
- New admin users in WordPress that nobody created
- Pages redirecting to spam, gambling or fake shopping sites
- Unfamiliar files or plugins appearing on the server
- A Google warning that the site may be hacked, or a malware notice from your host
- A sudden spike in emails going out from your web server
If you see any of these, contact your host straight away. This is also where a good backup earns its keep. A clean copy of the site from before 17 October makes recovery far easier, and our guide to backing up your business data covers how to keep one. You can report a cyber security incident to ASD on 1300 CYBER1 (1300 292 371).
Your website is often the first thing a new customer sees, and most owners only think about the server behind it when something goes wrong. If you are not sure who hosts your site, which PHP version it runs, or whether anyone is patching it, that is something we sort out for Perth businesses all the time through our website services.
