Australian Cyber Security Centre
Cybersecurity
Hundreds of thousands of servers run PHP versions that will never get the PHP2Shell fix
Small businesses, local councils, sports clubs and community charities running cheap shared hosting carry the heaviest exposure from two critical PHP vulnerabilities disclosed on 21 October 2026.