On 21 October 2026, PHP released emergency fixes for two critical security flaws that could let an attacker run code on a web server without logging in. Many WordPress and other PHP‑based websites are affected until their server’s PHP is updated. If your website runs on PHP, ask whoever hosts it to confirm the update has been applied. The websites we build don’t use PHP to deliver their pages, so they weren’t affected.

What happened

On 21 October 2026 (early on 22 October here in Australia), the team behind PHP released emergency security updates for two critical vulnerabilities, known as CVE‑2026‑109618 and CVE‑2026‑109619 and nicknamed “PHP2Shell”. Both are rated 9.2 out of 10 for severity.

In simple terms, the flaws could let someone take control of a web server by sending it a specially crafted request, without needing a password. The Australian Cyber Security Centre issued a critical alert, and security firms have reported early attack attempts since the details became public.

What is PHP?

PHP is a programming language that runs on many web servers. When someone visits a PHP‑based website, the server runs PHP to build the page before sending it to their browser. It has been around since the 1990s and powers a large share of the internet, including WordPress, Joomla, Drupal and many online stores.

Because these flaws sit in PHP itself rather than in any one website, a site can be well built and still be exposed if the server it runs on hasn’t been updated.

Why WordPress websites can be affected

WordPress is built with PHP, so every WordPress website relies on PHP running on its server. That doesn’t mean WordPress did anything wrong. It simply means a WordPress site is only as safe as the PHP version underneath it.

One detail catches many business owners out: WordPress automatic updates don’t update PHP. PHP is part of the hosting server, so it’s usually updated by your hosting provider or whoever manages your website. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions, PHP 8.1 and earlier, are no longer officially supported and won’t receive a normal update.

What business owners should do now

If your website runs on WordPress or another PHP‑based system, you don’t need to understand the technical details. You just need to know someone is taking care of it.

How we build websites differently

The websites we design and build are purpose‑built, using Webflow and custom‑coded development rather than WordPress. They don’t rely on PHP to deliver their pages, so this vulnerability didn’t affect them.

That’s not luck. Fewer moving parts means fewer things that can go wrong. There are no plugins to update, no database behind each page and far less software sitting between your website and your visitors. Security people call this a smaller attack surface. For you, it means simpler maintenance and less to worry about.

No website is immune to every security risk, and we don’t pretend otherwise. We still keep an eye on the platforms and servers we use, and our managed hosting includes security updates and backups. It just means a major PHP issue like this one isn’t a scramble for our clients. You can read more about the platforms we use in our FAQs.

Thinking about a new website?

If this news has you wondering how secure your current website is, or how much time it takes to keep it updated, it may be worth talking about. We build fast, purpose‑built websites for Canberra businesses and look after them once they’re live. Take a look at our website packages, or get in touch and we’ll give you straight advice and a fixed quote.

Sources

Australian Cyber Security Centre: Critical vulnerabilities in PHP. PHP security advisory and fixed releases: php.net.