> ## Content Index
> Fetch the complete content index at: https://www.bushletter.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Governments pull websites offline as hackers target critical PHP flaws
- URL: https://www.bushletter.com/php-patches-two-critical-rce-flaws-affecting-69-of-websites/
- Published: 2026-10-21T14:22:05.000Z
- Updated: 2026-10-23T03:58:01.000Z
- Description: Attackers are already trying to take over websites through two critical PHP flaws. WordPress updates won't protect you; your host has to act, today.
- Author: Bushletter Newsroom
- Tags: Cybersecurity, Australia, PHP, AI Security

TLDR

Attackers are already trying to break into websites through two critical PHP flaws that let them take over a web server without logging in. Governments in Finland and the Netherlands have switched off their own sites rather than risk it. A fix exists, but a website stays exposed until whoever runs its server installs it, and WordPress updates will not do that for you.

KEY TAKEAWAYS

01Two flaws in PHP, rated 9.2 out of 10, let attackers run their own code on a web server without a password.

02Patchstack, Cloudflare and watchTowr report attackers are already trying to exploit them.

03Finland's Valtori, the Dutch parliament and the Dutch cyber security centre have taken services offline as a precaution.

04WordPress updates will not fix it; your host or server administrator has to update PHP itself.

05About 18 per cent of WordPress sites run PHP 8.1 or older, which gets no official update.

● Live updates

Last updated 3:00pm AEDT, Friday 23 October. This story is being updated as new fixes, advice and timelines emerge.

- 4:43am AEDT, Fri 23 OctAnthropic's deputy chief information security officer Jason Clinton warned on X: "as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better." He urged security leaders to ask their boards for help with the basics. Bushletter's [AI and security series](https://www.bushletter.com/tag/ai-security/) covers the wider fallout, including firewalls and storage drives that run PHP. [(Jason Clinton on X)](https://x.com/JasonDClinton/status/2113325263157395456?ref=bushletter.com)
- Fri 23 Oct, AEDTHome and office storage devices are exposed too. QNAP said its QTS and QuTS hero systems are affected and fixes are still in progress, and advises removing direct internet access until they arrive. Synology said it "has released updated PHP packages addressing the vulnerabilities" for some of its apps. Updating a device's operating system does not fix PHP running inside Docker containers, which need their own updated images. [(AppleInsider)](https://appleinsider.com/articles/26/10/22/critical-php-vulnerabilities-threaten-your-nas-not-every-vendor-has-a-fix?ref=bushletter.com)
- Fri 23 Oct, AEDTOpenAI said the PHP bugs are "among several significant vulnerabilities we've already found and are working to fix" through its Patch the Planet program, and that "we expect similar findings to increase sharply in the coming months." It has not named the other affected software. [(OpenAI)](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/?ref=bushletter.com)
- 9:22pm AEDT, Thu 22 OctThe flaws reach beyond websites into security equipment. Palo Alto Networks confirmed all versions of its PAN-OS firewall software and Panorama are affected, with fixed releases not yet available; it advises restricting management interface access to trusted internal addresses in the meantime. Cisco is investigating 18 products and 13 cloud services and said "there are no workarounds for the vulnerabilities." Fortinet confirmed 12 products, including FortiOS, are not affected and is still checking 12 others. [(Help Net Security)](https://www.helpnetsecurity.com/2026/10/22/php2shell-vulnerability-fortinet-cisco-palo-alto-networks/?ref=bushletter.com)
- Thu evening 22 Oct, AEDTAmazon said its threat intelligence team caught someone trying to exploit PHP2Shell on 17 October, four days before the flaws were made public, through its honeypot network. Amazon's chief information security officer CJ Moses said "it remains unclear how the actor acquired exploit information prior to disclosure." Hosting platform Pantheon said it had blocked more than 60,000 suspicious requests. No successful compromise has been confirmed, but successful attacks may leave few traces. [(The Hacker News)](https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html?ref=bushletter.com)
- 5:19pm AEDT, Thu 22 OctEurope has started switching sites back on as patches go in. In the German state of Baden-Württemberg, ministry homepages were largely reachable again on Thursday morning local time after going dark on Wednesday, while many larger cities and the universities of Heidelberg and Konstanz were still offline. The state government said sites would return only once security updates were installed, and called the shutdown a precaution to protect its infrastructure. No compromise of those systems has been reported. [(Stuttgarter Nachrichten)](https://www.stuttgarter-nachrichten.de/baden-wuerttemberg/nach-sicherheitsluecke-webseiten-von-behoerden-im-suedwesten-gehen-nach-und-nach-wieder-online-79598084.html?ref=bushletter.com)
- 11:43am AEDT, Thu 22 OctThe US National Security Agency followed up with specific guidance, telling organisations to inventory every system that depends on PHP, add enhanced logging, and replace end-of-life PHP services "which will not be compatible with patching". It repeated that systems which cannot be updated straight away should be taken offline until they are fully mitigated. [(NSA)](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4630238/nsa-advisory-critical-patches-recommended-for-php-vulnerabilities/?ref=bushletter.com)
- Thu 22 Oct, AEDTAcross Asia, Singapore's Cyber Security Agency issued alert AL-2026-151 warning that the flaws affect all versions of PHP, and in Japan childcare centre systems and online games were taken offline as a precaution. Closer to home, the federal government's GovCMS platform runs on Drupal, which uses PHP, so agencies on it depend on the underlying servers being patched. [(Insurance Business Asia)](https://www.insurancebusinessmag.com/asia/news/cyber/critical-global-website-flaw-sparks-alerts-across-asiapac-as-attacks-begin-594447.aspx?ref=bushletter.com)
- 7:29am AEDT, Thu 22 OctCloudflare told developers: "Unpatched sites running PHP 5.4 or later are at risk of remote code execution, data exposure, and crashes." It said sites proxied through Cloudflare had protections in place before public disclosure, but firewall rules buy time and do not replace the PHP update. [(Cloudflare Developers on X)](https://x.com/CloudflareDev/status/2113004792880693280?ref=bushletter.com)
- 6:30am AEDT, Thu 22 OctGoDaddy said it has patched every PHP version on its Managed WordPress hosting. Its shared Web Hosting and Windows Hosting servers are still waiting on patched packages from a vendor, with interim mitigations in place. GoDaddy VPS customers manage their own servers and have to update PHP themselves. [(GoDaddy)](https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do?ref=bushletter.com)
- 6:15am AEDT, Thu 22 OctThe Canadian Centre for Cyber Security issued alert AL26-026 on the two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and urged administrators to apply the updates. [(Canadian Centre for Cyber Security on X)](https://x.com/cybercentre%5Fca/status/2112986092093718552?ref=bushletter.com)
- 3:50am AEDT, Thu 22 OctExploit attempts are now hitting security firms' sensors. watchTowr said attempts reached its sensors around the time the patches landed, none successful so far, and its head of threat intelligence Jake Knott said: "Whilst nobody has been successful to date, we don't expect that will last long." Attack surface firm Hadrian went further and said it was seeing the flaw exploited in the wild at scale. [(SecurityWeek)](https://www.securityweek.com/php2shell-patches-land-as-first-exploitation-attempts-hit-sensors/?ref=bushletter.com)
- 3:40am AEDT, Thu 22 OctThe US Cybersecurity and Infrastructure Security Agency said: "Organizations should immediately patch critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619." CISA said the flaws "enable unauthenticated RCE and affect PHP installations serving web requests". [(CISA on X)](https://x.com/CISACyber/status/2112947079458717969?ref=bushletter.com)
- 3:25am AEDT, Thu 22 OctHostinger said it tested the flaw on its live servers and that "it can't be used to take over sites hosted with us, WordPress included." It is applying the PHP fix across all hosting regardless. That is the host's own assessment, and customers running their own servers or VPS plans still need to patch. [(Hostinger on X)](https://x.com/Hostinger/status/2112943242291343380?ref=bushletter.com)
- 2:30am AEDT, Thu 22 OctOpinion: AI found PHP's worst flaw in years, and attackers have the same tools. [Read Bushletter's view](https://www.bushletter.com/php2shell-shows-ai-changed-the-economics-of-software-flaws/).
- 2:22am AEDT, Thu 22 OctGermany's Federal Office for Information Security (BSI) rated the threat orange, level 3 of 4, and advised website operators to take their servers completely offline if in doubt. The city of Mainz switched off mainz.de and several council services, and other German councils, universities and hospitals followed. [(ZDFheute)](https://www.zdfheute.de/politik/sicherheitsluecke-php-webseiten-onlinedienste-cybersicherheit-bsi-100.html?ref=bushletter.com)
- 2:07am AEDT, Thu 22 OctwatchTowr credited security firm Calif with discovering PHP2Shell and said it had "now shared further information aimed at helping end users". Huntress said on X: "All PHP installations serving web requests are at risk, making patching urgent." [(watchTowr on X)](https://x.com/watchtowrcyber/status/2112923764270768398?ref=bushletter.com)
- Early Thu 22 Oct, AEDTThe UK NCSC updated its advisory to say "this security issue has now been fixed" and urged all organisations to move to the latest version, including appliances and third-party products that bundle PHP. Hosting control panel maker cPanel is preparing updated PHP builds, and CloudLinux is expected to backport fixes to older versions. [(Precursor Security)](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com)
- Early Thu 22 Oct, AEDTThe disruption spread overnight. The Wikimedia Foundation took a number of systems down as a precaution until they could be patched. Local government sites in France were temporarily disconnected, and in Denmark a national school communication platform was affected. Automattic said sites on WordPress.com, WordPress VIP, WP Cloud and Pressable were already protected, and Drupal told its users a patched PHP release is the only complete fix. [(Newsweek)](https://www.newsweek.com/php-vunerability-php2shell-issue-websites-hack-server-12601225?ref=bushletter.com)
- Early Thu 22 Oct, AEDTThe flaws were found by Wiz, Calif and OpenAI. Wiz chief technology officer Ami Luttwak called it the "most severe vulnerability found using AI ever". Download servers at php.net are slow under load; administrators are using their Linux distribution's packages instead and must restart PHP-FPM or Apache after updating. [(Precursor Security)](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com)
- 1:55am AEDT, Thu 22 OctUbuntu said: "Ubuntu has released fixes for the affected packages for all supported releases." Servers running a Linux distribution's PHP should be updated through its package manager, then PHP-FPM or Apache restarted. [(Ubuntu on X)](https://x.com/ubuntu/status/2112920618161115556?ref=bushletter.com)
- 1:04am AEDT, Thu 22 OctOpenAI said its models helped researchers find the flaws as part of its Patch the Planet initiative, and that over the past two months it led a coalition of maintainers, researchers and security providers to prepare fixes. [(OpenAI on X)](https://x.com/OpenAI/status/2112907856018309586?ref=bushletter.com)
- 1:00am AEDT, Thu 22 OctPHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 and said no complete workaround exists. PHP 8.1 and older get no official release; minimal source-code backports were published for 7.4, 8.0 and 8.1\. [(PHP.net)](https://www.php.net/?ref=bushletter.com)
- 12:46am AEDT, Thu 22 OctThe US National Security Agency's cyber security arm said: "Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities." It said that if an immediate update is not feasible, organisations should take the system offline until it can be fully mitigated, and that more specific guidance would follow. [(NSA Cyber on X)](https://x.com/NSACyber/status/2112903220209098897?ref=bushletter.com)
- 12:38am AEDT, Thu 22 OctA Wiz researcher published the technical findings and confirmed working remote code execution without a login against WordPress, Drupal and Joomla, plus remote memory disclosure from any PHP application. Put simply, attackers do not need a password to take over an unpatched site running any of the three. [(Wiz researcher on X)](https://x.com/sagitz%5F/status/2112901380080058778?ref=bushletter.com)
- Late Wed 21 Oct, AEDTJapanese Prime Minister Sanae Takaichi posted on X urging organisations to prepare to apply the patch as soon as possible, and said temporarily taking websites offline is "one effective measure for reducing risk". Japan's National Cyber Coordination Office issued an alert, and Japanese platforms including Niconico and pixiv went into emergency maintenance. [(BigGo Finance)](https://finance.biggo.com/news/ecd6fc47-2403-4e2c-90d1-bc2b32b48fad?ref=bushletter.com)
- Wed evening 21 Oct, AEDTGovernments began switching off their own sites as a precaution: Finland's government IT agency Valtori shut public-facing central government services, and the Dutch parliament, NCSC-NL and the Dutch data protection authority went offline, along with German hospitals and the universities of Vienna and Freiburg. [(Precursor Security)](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com)
- Wed evening 21 Oct, AEDTCloudflare chief technology officer Dane Knecht said the company was "seeing early attacks emerging" and pushed emergency firewall rules to all customers, including free plans. Cloudflare describes the rules as a stopgap, not a fix. [(Tenable)](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=bushletter.com)
- 9:23pm AEDT, Wed 21 OctVirusTotal sized the exposure with its internet scanning: about 758,000 internet-facing servers run PHP 5.4 to 8.1, versions that no longer get official fixes, against about 272,000 on supported versions. Other researchers put the total of exposed hosts between 1.3 million and 1.9 million. [(CyberScoop)](https://cyberscoop.com/php-emergency-patches-php2shell-vulnerabilities/?ref=bushletter.com)
- 9:02pm AEDT, Wed 21 OctThe Australian Signals Directorate said: "We are aware of an outage that may be affecting Government websites, including cyber.gov.au." It told organisations and individuals using PHP to monitor official guidance and apply security patches as they become available. [(ASD on X)](https://x.com/ASDGovAu/status/2112846975179899197?ref=bushletter.com)
- 6:34pm AEDT, Wed 21 OctSecurity firm Patchstack reported active exploitation attempts against several hosting companies, more than six hours before the fix was released. [(Patchstack)](https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/?ref=bushletter.com)
- 2:56pm AEDT, Wed 21 OctASD's Australian Cyber Security Centre issued a critical alert, saying the vulnerabilities "may affect all versions from PHP 5 onwards" and that "Organisations and individuals should monitor PHP applications and prepare to update and apply patches." Report incidents on 1300 CYBER1\. [(ASD on X)](https://x.com/ASDGovAu/status/2112754887113220213?ref=bushletter.com)
- Wed 21 Oct, AEDT (Tuesday evening in Europe)CERT-EU, the cyber security team for EU institutions, issued advisory 2026-018 telling organisations that cannot patch quickly to consider isolating internet-facing PHP applications from public networks until a fix can be applied. [(The Next Web)](https://thenextweb.com/news/php-vulnerability-cert-eu-websites-offline?ref=bushletter.com)
- 6:33am AEDT, Wed 21 OctAfter details leaked online, the PHP security team announced an emergency release for two critical flaws rated 9.2 out of 10, and told users to prepare to update immediately. [(php.announce)](https://news-web.php.net/php.announce/509?ref=bushletter.com)

## One request is enough to take over a server

Attackers are already trying to break into websites through two critical flaws in PHP, the software that runs most of the web, and governments in Europe have switched off their own sites rather than risk it. The flaws, CVE-2026-109618 and CVE-2026-109619, are both rated 9.2 out of 10 and let an attacker run their own code on a web server without logging in.[\[1\]](https://www.php.net/?ref=bushletter.com) PHP said every installation that serves web pages is affected, and that the greatest risk is on servers using Apache's mod\_php, where an unauthenticated request can trigger the attack before the website's own code runs.[\[1\]](https://www.php.net/?ref=bushletter.com)

Security firm Patchstack said exploitation attempts against several hosting companies began at 07:34 UTC on 21 October, hours before the fix was published.[\[9\]](https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/?ref=bushletter.com)[\[8\]](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com) Cloudflare chief technology officer Dane Knecht said: "We are seeing early attacks emerging and are updating mitigations as new vectors show up."[\[4\]](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=bushletter.com) Jake Knott, head of threat intelligence at watchTowr, said: "Whilst nobody has been successful to date, we don't expect that will last long."[\[7\]](https://therecord.media/php-script-vulnerabilities-warnings?ref=bushletter.com)

Dane Knecht @dok2001

We are seeing early attacks emerging and are updating mitigations as new vectors show up.

[October 21, 2026 · View on X](https://x.com/dok2001/status/2112811965735202970?ref=bushletter.com)

## Governments are switching their own sites off

Finland's government IT agency Valtori shut down public-facing central government services on 21 October, and the Dutch parliament, the Dutch national cyber security centre NCSC-NL and the Dutch data protection authority took services offline.[\[8\]](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com) German hospitals and the universities of Vienna and Freiburg also switched systems off, and Japanese platforms Niconico and pixiv went into emergency maintenance.[\[8\]](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com) Valtori said "these shutdowns are precautionary, not in response to a breach".[\[8\]](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com)

CERT-EU, the cyber security service for EU institutions, advised "isolating internet-facing applications from public networks until a fix is available".[\[11\]](https://www.itnews.com.au/news/critical-flaws-strike-php-as-disclosure-embargo-is-broken-629794?ref=bushletter.com)[\[10\]](https://cert.europa.eu/publications/security-advisories/2026-018/?ref=bushletter.com) The UK NCSC told organisations that cannot protect a system in time to "consider taking the system offline until it can be fully mitigated".[\[3\]](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php?ref=bushletter.com) In Australia, ASD's Australian Cyber Security Centre issued a critical alert telling organisations to find every PHP installation, patch as soon as fixes were released and watch PHP applications for suspicious activity.[\[2\]](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php?ref=bushletter.com)

The US National Security Agency went further on its cyber security account: "Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities." The agency said "these vulnerabilities often provide a direct path to the server's file system or database" and that organisations unable to update should "take the system offline until it can be fully mitigated".[\[NSA\]](https://x.com/NSACyber/status/2112903220209098897?ref=bushletter.com) Japanese Prime Minister Sanae Takaichi told organisations on X that temporarily taking websites offline is "one effective measure for reducing risk".[\[Takaichi\]](https://finance.biggo.com/news/ecd6fc47-2403-4e2c-90d1-bc2b32b48fad?ref=bushletter.com) In Canberra, the Australian Signals Directorate said on Wednesday night: "We are aware of an outage that may be affecting Government websites, including cyber.gov.au."[\[ASD\]](https://x.com/ASDGovAu/status/2112846975179899197?ref=bushletter.com)

## Why the fix does not make your site safe

PHP released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 1am AEDT on 22 October and said no complete workaround exists.[\[1\]](https://www.php.net/?ref=bushletter.com) The fix only protects a website once it is installed on the server the site runs on, and for most businesses that is the hosting company's job. Security firm Wordfence said "WordPress automatic updates will not apply this fix". Wiz Research, which helped find the flaws, said "Applying the PHP security update remains the only complete remediation".[\[Wiz\]](https://www.wiz.io/blog/php2shell-php-rce?ref=bushletter.com) The UK NCSC said "this security issue has now been fixed" and that "all organisations are highly encouraged to update to the latest fixed version".[\[NCSC\]](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php?ref=bushletter.com)[\[6\]](https://nebula.design/security/php2shell/?ref=bushletter.com)

Older servers are worse off. About 18 per cent of WordPress sites and nearly 24 per cent of Joomla sites run PHP 8.1 or older, which the PHP project no longer updates, according to monitoring service mysites.guru.[\[8\]](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com) Source-code backports exist for PHP 7.4, 8.0 and 8.1, and Linux distributions received patches in advance, but someone still has to build or install them.[\[5\]](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/?ref=bushletter.com) Joviane Jardim, senior security researcher at Detectify, said "the flaws became public before the fix did, so both sides are starting at the same time".[\[7\]](https://therecord.media/php-script-vulnerabilities-warnings?ref=bushletter.com)

Configuration tweaks will not hold attackers off. Joe Ferguson, release manager for PHP 8.6, said: "INI settings won't save you."[\[4\]](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=bushletter.com) Gina Peter Banyard, a PHP core developer, said "the only mitigation is patching / upgrading PHP".[\[4\]](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=bushletter.com)

## What to do in the next 24 hours

1. Assume you are exposed. If your website runs on WordPress, Drupal, Joomla, Magento, Laravel or anything else built on PHP, treat it as vulnerable until someone confirms otherwise.[\[4\]](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=bushletter.com)
2. Contact your host or IT provider today and ask them to confirm in writing that both CVE-2026-109618 and CVE-2026-109619 are fixed on your server. Backported builds may not change the version number, so the number alone does not prove it.[\[6\]](https://nebula.design/security/php2shell/?ref=bushletter.com)
3. If you run your own server, update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or install your Linux distribution's patched package, then restart PHP-FPM or Apache so the old version stops running.[\[1\]](https://www.php.net/?ref=bushletter.com)[\[8\]](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com)
4. Find every PHP installation, starting with anything facing the internet, including products and appliances that bundle PHP inside them.[\[3\]](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php?ref=bushletter.com)
5. If you cannot confirm the fix, take the site offline until you can, as the NCSC and CERT-EU advise. Firewall rules from Cloudflare and others are a stopgap only.[\[3\]](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php?ref=bushletter.com)[\[10\]](https://cert.europa.eu/publications/security-advisories/2026-018/?ref=bushletter.com)[\[4\]](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=bushletter.com)
6. Back up to a location off the server and check you can restore it.[\[6\]](https://nebula.design/security/php2shell/?ref=bushletter.com)
7. Check for signs of compromise, such as unfamiliar files or backdoors, on any system that was exposed before it was patched.[\[3\]](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php?ref=bushletter.com)
8. Report incidents to the ACSC on 1300 CYBER1 (1300 292 371) or through ReportCyber at cyber.gov.au.[\[2\]](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php?ref=bushletter.com)

## What individuals should do

Most people cannot patch the websites they use, but they can limit the damage if a site they rely on is breached. ASD's ACSC has long recommended turning on multi-factor authentication for important accounts and using a different strong passphrase for each one. Be wary of unexpected emails or texts about the PHP flaws or urgent password resets: scammers often exploit big security news, so go to a website directly rather than clicking a link. Report scams and cyber crime through ReportCyber at [cyber.gov.au](https://www.cyber.gov.au/?ref=bushletter.com), where the ACSC's general guidance on multi-factor authentication and passphrases is also published.

## Resources

- [ASD's ACSC critical alert: Critical vulnerabilities in PHP](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php?ref=bushletter.com), and ReportCyber at [cyber.gov.au](https://www.cyber.gov.au/?ref=bushletter.com) or 1300 CYBER1
- [PHP downloads](https://www.php.net/downloads.php?ref=bushletter.com) and [PHP security release notes](https://www.php.net/?ref=bushletter.com)
- [UK NCSC advisory](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php?ref=bushletter.com) and [CERT-EU advisory 2026-018](https://cert.europa.eu/publications/security-advisories/2026-018/?ref=bushletter.com)
- [Tenable php2shell FAQ](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=bushletter.com), including how to find PHP installations
- [Patchstack alert for WordPress site owners](https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/?ref=bushletter.com)
- [How WordPress owners can check their PHP version and what to ask their host](https://nebula.design/security/php2shell/?ref=bushletter.com) (Tools, Site Health, Info, Server)

**Important:** This article is general information only. It is not legal, technical, cyber security or professional advice, and it does not take account of your systems or circumstances. Details of these vulnerabilities, affected versions and fixes are changing quickly and are drawn from the public sources cited, which Bushletter has not independently tested. Before acting, check the current guidance from the PHP project, ASD's Australian Cyber Security Centre and your software and hosting providers, and get advice from a qualified security professional. Bushletter accepts no liability for any loss arising from reliance on this article, and nothing in it is an assurance that any step will secure a system.

If you believe your organisation has been compromised, contact ASD's ACSC on 1300 CYBER1 (1300 292 371) or report through ReportCyber at cyber.gov.au.

SOURCES & CITATIONS

1. [PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 security releases, PHP.net](https://www.php.net/?ref=bushletter.com)
2. [Critical vulnerabilities in PHP, ASD's Australian Cyber Security Centre](https://www.cyber.gov.au/alert/critical-vulnerabilities-in-php?ref=bushletter.com)
3. [Critical security issue affecting PHP, UK National Cyber Security Centre](https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php?ref=bushletter.com)
4. [php2shell FAQ, Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote?ref=bushletter.com)
5. [PHP2Shell: critical PHP vulnerabilities patched, Help Net Security](https://www.helpnetsecurity.com/2026/10/21/php2shell-php-vulnerabilities-patched-cve-2026-109618-cve-2026-109619/?ref=bushletter.com)
6. [PHP2Shell: the PHP update WordPress can't install for you, Nebula Design (citing Wordfence)](https://nebula.design/security/php2shell/?ref=bushletter.com)
7. [Hundreds of websites taken offline as concern grows over two PHP vulnerabilities, The Record](https://therecord.media/php-script-vulnerabilities-warnings?ref=bushletter.com)
8. [Live blog: PHP2Shell critical PHP RCE vulnerabilities, Precursor Security](https://www.precursorsecurity.com/blog/php2shell-critical-php-rce-vulnerabilities?ref=bushletter.com)
9. [Major security alert: PHP vulnerable to critical RCE, attacks ongoing, Patchstack](https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/?ref=bushletter.com)
10. [Security advisory 2026-018: critical vulnerabilities in PHP, CERT-EU](https://cert.europa.eu/publications/security-advisories/2026-018/?ref=bushletter.com)
11. [Critical flaws strike PHP as disclosure embargo is broken, iTnews](https://www.itnews.com.au/news/critical-flaws-strike-php-as-disclosure-embargo-is-broken-629794?ref=bushletter.com)

FREQUENTLY ASKED QUESTIONS

Is my website affected by the PHP flaws?

If your site runs on PHP, which includes WordPress, Drupal, Joomla, Magento and Laravel sites, assume it is exposed until your host or server administrator confirms PHP has been updated to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or to a vendor build that fixes both CVE-2026-109618 and CVE-2026-109619.

Will updating WordPress or my plugins fix it?

No. Wordfence said WordPress automatic updates will not apply this fix. The flaws are in PHP, which runs on the server, so your host or server administrator has to update it.

What should my business do today?

Ask your host in writing to confirm both CVEs are fixed on your server, back up your site off the server, and find any other PHP systems you run. If you cannot confirm the fix, the UK NCSC and CERT-EU advise taking the system offline until it is protected.

My site runs PHP 8.1 or older. What now?

PHP 8.1 and older get no official update. Ask your host or Linux vendor for a backported fix or move to a supported version, and consider taking the site offline until one of those is in place.

How do I check which PHP version my site uses?

In WordPress, go to Tools, Site Health, Info and open the Server section. For other sites, ask your host, and ask them to confirm the fix rather than relying on the version number.

Are attackers already exploiting the flaws?

Yes, attempts are under way. Patchstack reported exploitation attempts against hosting companies from 21 October, Cloudflare said it is seeing early attacks, and attack surface firm Hadrian said it is seeing the flaw exploited in the wild at scale. watchTowr said no attempt against its sensors had succeeded yet but did not expect that to last. Wiz confirmed working attacks that need no login against WordPress, Drupal and Joomla.

Is my hosting company already protecting me?

Some large hosts say they have patched or shielded customers. Automattic says WordPress.com, WordPress VIP, WP Cloud and Pressable sites are protected, GoDaddy says its Managed WordPress hosting is patched while its shared hosting waits on vendor packages, and Hostinger says it is applying the fix across all hosting. Cloudflare's firewall rules give proxied sites some cover but are not a fix. If you run your own server or VPS, nobody is patching it for you. Ask your host in writing which PHP version your site runs and when it was patched.

Who do I contact if I think my site has been hacked?

Australian organisations can call the ACSC on 1300 CYBER1 (1300 292 371) or report through ReportCyber at cyber.gov.au, and should engage an incident response provider.

I don't run a website. Do I need to do anything?

Turn on multi-factor authentication for important accounts, use a different strong passphrase for each, and treat unexpected emails or texts about the PHP flaws or urgent password resets with suspicion. Go to websites directly rather than clicking links, and report scams through ReportCyber at cyber.gov.au.