> ## Content Index
> Fetch the complete content index at: https://www.bushletter.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Hundreds of thousands of servers run PHP versions that will never get the PHP2Shell fix
- URL: https://www.bushletter.com/758-000-unpatched-php-servers-leave-councils-and-charities-exposed/
- Published: 2026-10-23T04:45:00.000Z
- Updated: 2026-10-23T04:44:59.000Z
- Description: Small businesses, local councils, sports clubs and community charities running cheap shared hosting carry the heaviest exposure from two critical PHP vulnerabilities disclosed on 21 October 2026.
- Author: Bushletter Newsroom
- Tags: Cybersecurity, Australia, Australian Cyber Security Centre, AI Security

TLDR

Two critical PHP flaws allow unauthenticated attackers to run code remotely on servers from PHP 5 onwards, prompting an ACSC critical alert. About 758,000 internet-facing servers run end-of-life PHP versions with no official patch available, far outnumbering the 272,000 on supported branches.

KEY TAKEAWAYS

01ACSC issued a critical alert covering all PHP versions from PHP 5 onwards on 21 October 2026.

02About 758,000 internet-facing servers run end-of-life PHP 5.4 to 8.1, where no official patch exists.

03GovCMS hosts over 100 government entities on Drupal and PHP, placing federal sites directly in scope.

04Fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released on 21 October 2026.

05Big hosts are patching shared servers, but anyone running their own server or VPS must update PHP themselves.

## Who faces the greatest risk

Small businesses, local councils, sports clubs and community charities running cheap shared hosting carry the heaviest exposure from two critical PHP vulnerabilities disclosed on 21 October 2026\. These organisations typically sit on old shared-hosting plans configured years ago and left largely unattended, making them the most likely to still be running end-of-life PHP branches with no official fix available.

VirusTotal scans conducted on 21 October 2026 found approximately 758,000 internet-facing servers disclosing an end-of-life PHP version between 5.4 and 8.1, against roughly 272,000 running supported branches.[\[1\]](https://blog.virustotal.com/2026/10/sizing-php-exposure-window-for-cve-2026.html?ref=bushletter.com) End-of-life branches receive no official patches from the PHP project, meaning those 758,000 servers have no vendor-supplied fix for CVE-2026-109618 and CVE-2026-109619.

The two flaws, collectively tracked under the name php2shell, allow unauthenticated actors to execute code remotely on any vulnerable server.[\[2\]](https://x.com/ASDGovAu/status/2112754887113220213?ref=bushletter.com) A successful attack gives an adversary the same level of access as the web server process itself, which on shared hosting can expose every site on the same machine.

## Government in the crosshairs

GovCMS hosted websites for 103 government entities across Australian governments, according to the Department of Finance's 2022-23 annual report.[\[3\]](https://www.finance.gov.au/sites/default/files/2024-05/Department-of-finance-annual-report-2022-23%5F0.pdf?ref=bushletter.com) The platform runs on Drupal, which is built on PHP, placing every GovCMS-hosted site directly within the scope of the ACSC alert.[\[4\]](https://www.govcms.gov.au/?ref=bushletter.com)

The Australian Signals Directorate's Australian Cyber Security Centre said on 21 October 2026 that ASD's ACSC understands that all PHP versions from PHP 5 onwards may be affected, and directed organisations to prepare to update and apply security patches as they become available.[\[2\]](https://x.com/ASDGovAu/status/2112754887113220213?ref=bushletter.com) The ACSC rated it a critical alert and asked anyone affected to report incidents on 1300 CYBER1 (1300 292 371).

Australia's Essential Eight framework requires internet-facing services to be patched within 48 hours when a working exploit exists. The fixes were released on 21 October, so that clock is already running for anyone who has not patched.[\[2\]](https://x.com/ASDGovAu/status/2112754887113220213?ref=bushletter.com)

## What fixed versions are available

The PHP project released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October 2026 to address the two vulnerabilities.[\[5\]](https://www.php.net/archive/2026.php?ref=bushletter.com) PHP 8.1 and older are end of life and get no official release; the PHP project published only minimal source-code fixes for 7.4, 8.0 and 8.1, which most small organisations will not be able to apply themselves.

Hostinger said on 22 October that the flaw "can't be used to take over sites hosted with us, WordPress included", and that it was applying PHP's fix across all its hosting anyway.[\[6\]](https://x.com/Hostinger/status/2112943242291343380?ref=bushletter.com) Customers who run their own servers still need to patch them.

GoDaddy said it has patched every PHP version on its Managed WordPress hosting, while its shared Web Hosting and Windows Hosting servers were still waiting on patched packages from a vendor, with interim mitigations in place. GoDaddy VPS customers have to update PHP themselves.[\[7\]](https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do?ref=bushletter.com)

## What to ask your host this week

Anyone running a website on shared hosting should ask their provider three questions: which PHP version the server is currently running; whether the php2shell patches have been applied at the server level; and, if not, what the expected timeline is. Managed hosting customers whose provider has already patched may need to take no further action, but the answer needs to come in writing.

VPS and dedicated server customers bear full responsibility for patching their own environments. Upgrading to PHP 8.2 as a minimum and then applying version 8.2.35 or higher covers the fix. Organisations that cannot immediately upgrade from an end-of-life branch should contact their hosting provider about temporary mitigations while a longer-term upgrade is planned.

The ACSC critical alert published on 21 October 2026 remains the authoritative reference for Australian organisations assessing their exposure. Bushletter's [live PHP2Shell coverage](https://www.bushletter.com/php-patches-two-critical-rce-flaws-affecting-69-of-websites/) tracks new fixes and advice, and the [AI and security series](https://www.bushletter.com/tag/ai-security/) follows the wider fallout.[\[2\]](https://x.com/ASDGovAu/status/2112754887113220213?ref=bushletter.com)[\[5\]](https://www.php.net/archive/2026.php?ref=bushletter.com)

SOURCES & CITATIONS

1. [VirusTotal: Sizing the PHP exposure window for CVE-2026](https://blog.virustotal.com/2026/10/sizing-php-exposure-window-for-cve-2026.html?ref=bushletter.com)
2. [ASD: critical alert on PHP vulnerabilities, on X](https://x.com/ASDGovAu/status/2112754887113220213?ref=bushletter.com)
3. [Department of Finance Annual Report 2022-23](https://www.finance.gov.au/sites/default/files/2024-05/Department-of-finance-annual-report-2022-23%5F0.pdf?ref=bushletter.com)
4. [GovCMS official site](https://www.govcms.gov.au/?ref=bushletter.com)
5. [PHP project release archive 2026](https://www.php.net/archive/2026.php?ref=bushletter.com)
6. [Hostinger on X](https://x.com/Hostinger/status/2112943242291343380?ref=bushletter.com)
7. [GoDaddy: Important PHP security update](https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do?ref=bushletter.com)

FREQUENTLY ASKED QUESTIONS

Which PHP versions are affected by CVE-2026-109618 and CVE-2026-109619?

The ACSC said all PHP versions from PHP 5 onwards may be affected. Fixed versions exist for 8.2, 8.3, 8.4 and 8.5\. Versions 8.1 and below are end of life and get no official release.

How many internet-facing servers are running unpatched PHP?

VirusTotal scans from 21 October 2026 found approximately 758,000 internet-facing servers running end-of-life PHP branches 5.4 to 8.1, with no official fix available for those versions.

Does GovCMS host Australian government websites on PHP?

Yes. GovCMS uses Drupal, which runs on PHP, and hosted websites for 103 government entities according to the Department of Finance's 2022-23 annual report, so those sites depend on the underlying PHP being patched.

What should shared hosting customers do right now?

Contact your host to confirm which PHP version your server runs and whether php2shell patches have been applied. Managed hosting customers at providers such as Hostinger may already be covered. VPS customers must patch themselves, targeting PHP 8.2.35 or higher.