PHP Security Flaw (php2shell): What Canberra Website Owners Need to Do
Two critical PHP bugs were fixed on 21 October 2026. For Canberra website owners, community groups and small businesses.
By Harsimran (Harry) Singh, Director · CCNA R&S, ITIL 4, MCSA, ACS Certified Professional · Updated 22 October 2026
Whether it's a small business site, a club or association page, or a WordPress site run from the spare room, a PHP flaw rated 9.2 out of 10 deserves a few minutes of your attention. You won't be patching PHP yourself. What you can do is find out whether your host has, and check that nothing nasty has already arrived. This is the short version for Canberra and the ACT.
Want every detail — server settings, exact fixes and all? Read our full Geeks Brisbane guide to the php2shell PHP vulnerability. This page is the short, local version, as at 22 October 2026.
What Happened
On 21 October 2026, the PHP project released fixes for two critical security flaws, nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 (CVSS v4.0, critical). Either one can allow unauthenticated remote code execution — in plain English, someone on the internet may be able to run their own code on the web server that hosts your website, without ever logging in.
The important part: this is a bug in PHP itself, the programming language behind WordPress, WooCommerce, Joomla, Drupal, Magento and most cPanel and Plesk hosting. It is not a fault in your plugin or theme, and keeping WordPress up to date does not remove it. The fix is a new PHP build installed on the server. PHP's own advice: there are no complete mitigations, updating is the only safe choice.
How urgent? Security firms are reporting early attack attempts, and exploit code is circulating. Treat it as urgent — calmly.
Check Your PHP Version in Five Minutes
WordPress (easiest)
- Log in to your WordPress dashboard (usually yourwebsite.com.au/wp-admin).
- Go to Tools → Site Health, then click the Info tab.
- Open the Server section and find PHP version. Write down the full number, for example 8.3.30.
- Compare it with the table below. If the last number is lower than the fixed version for your branch, you are not patched yet.
cPanel hosting
Go to Software → Select PHP Version (CloudLinux) or MultiPHP Manager. This shows the branch (for example 8.4). The exact patch number (8.4.27) may only appear in a phpinfo page or from your host — so ask them.
Plesk hosting
Go to Websites & Domains → PHP Settings and read the PHP version.
What counts as patched
| PHP branch | Fixed version | Notes |
|---|---|---|
| PHP 8.5 | 8.5.12 or newer | Supported |
| PHP 8.4 | 8.4.27 or newer | Supported |
| PHP 8.3 | 8.3.36 or newer | Supported |
| PHP 8.2 | 8.2.35 or newer | Reaches end of life on 31 December 2026 — plan a move to 8.3 or newer |
| PHP 8.1 and older | No official fixed release | End of life. PHP published minimal source backports for 7.4, 8.0 and 8.1 only (build-from-source). Some distributions and long-term-support vendors ship their own backported builds — ask yours. |
Message Your Host (Copy and Paste)
On shared or managed hosting you usually can't patch PHP yourself — your host has to. So your job is to ask clearly, get an answer in writing, and then verify. Copy, paste and fill in the square brackets:
Subject: Urgent: PHP security update (php2shell) for my website [your domain]
Hi,
PHP published critical security fixes on 21 October 2026 for two vulnerabilities nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). My website is [your domain], account/username [if you know it]. Could you please tell me:
- Which PHP version, and exact patch build, is my site running right now?
- When will you install (or when did you install) PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-supported fix if my site is on an older PHP branch?
- Have the PHP workers been restarted since the update was installed?
- What interim protection (for example WAF rules) is in place until then?
- Have you checked my account for signs of compromise?
Please reply in writing so I have a record. Thank you.
[Your name] · [Your phone number]
As at 22 October 2026, cPanel's EasyApache 4 fixed PHP builds have been released for all versions, Plesk Obsidian updates are available, and CloudLinux's alternative PHP builds are rolling out. That doesn't tell you whether your host has installed them yet — which is why you ask.
Signs Something May Be Wrong
Most sites will show nothing at all, and there is no need to assume the worst. But because exploit attempts are being reported, it's worth a calm check for these signs:
- New or unfamiliar files in your website folders, especially
.phpfiles inside the uploads folder - Admin users in WordPress that you didn't create
- Plugins you don't recognise, or unexpected scheduled tasks (cron jobs)
- Spam pages, strange redirects, or Google showing "This site may be hacked" (or a security issue in Search Console)
- A sudden spike in server load or outgoing traffic, or an email from your host about suspension
If you see any of them: don't just delete the odd file. Change your passwords first (hosting account, WordPress admins, database and SFTP), then restore from a clean backup if needed and scan the site — and only then patch PHP. Deleting one file while the door stays open usually means it comes back. In Australia you can report an incident and get advice from the Australian Cyber Security Centre (1300 CYBER1, or 1300 292 371).
Also worth doing while you wait: make sure your domain's Cloudflare record, if you use Cloudflare, shows the orange cloud (Proxied) — its protection rules only cover proxied traffic — and confirm you have a restorable backup stored away from the site.
How We Help in Canberra and the ACT
We help website owners across Canberra, Queanbeyan and the surrounding ACT suburbs, remotely or on site. Send us your website address and we'll start from there.
- We check which PHP version your site is running
- We contact your host for you and chase a written answer
- We check for signs of compromise
- We help turn on Cloudflare protection
- We make sure your backups work
Remote support is $125/hr and an onsite visit is $205/hr, with a one-hour minimum and no call-out fee. You'll know the cost before we start.
What we can't do On shared or managed hosting only the host can install the PHP fix, and we can't promise a site is untouched. We'll tell you honestly what we find.
Running a business? See our business IT support and managed IT plans.
Common questions
"php2shell" is the nickname for two critical bugs in PHP (CVE-2026-109618 and CVE-2026-109619), the language most websites run on, including WordPress and WooCommerce. Both are rated 9.2 out of 10 (CVSS v4.0) and can let an attacker run code on the web server without logging in. PHP released fixes on 21 October 2026.
No. The flaw is in PHP itself, so a fully updated WordPress, theme and set of plugins doesn't remove it. The fix is a new PHP build on the server.
Security firms are reporting early attack attempts, and exploit code is circulating, so treat it as urgent. As at 22 October 2026 we can't responsibly say more than that, and nobody should be quoting numbers of victims.
Look for unfamiliar files (especially .php in uploads), admin users you didn't create, unknown plugins or scheduled tasks, spam pages or redirects, a Google "may be hacked" warning, or a spike in server load. If you find any, change your passwords, restore from a clean backup if needed, scan, then patch.
On shared or managed hosting we can't install PHP on your host's server — only the host can. What we do is check your version, send your host the right questions and chase the answer, check for signs of compromise, help turn on Cloudflare protection and make sure your backups work. Remote support is $125/hr and an onsite visit is $205/hr, both with a one-hour minimum and no call-out fee. You'll know the cost before we start.
Sources
PHP security advisory, 21 October 2026 · PHP supported versions · Tenable — php2shell FAQ · Cloudflare — WAF protection for the PHP vulnerabilities · CloudLinux incident notice · Australian Cyber Security Centre (cyber.gov.au). Everything here is stated as at 22 October 2026 and may change as vendors release updates.
Book a Canberra technician
$205/hr on site, $125/hr remote, no call-out fee, one-hour minimum.
Book OnlinePlease note: this guide is general information as at 22 October 2026, drawn from PHP and vendor advisories, and makes no promises about any particular website. Rates shown are our own published rates.