Your website can look perfectly healthy while the software underneath it needs an urgent update. That is the practical lesson from PHP2Shell: two critical security flaws in PHP, the technology behind platforms including WordPress and WooCommerce. Updating your website’s plugins is important, but it does not repair the PHP engine running on your hosting server.
This is not a reason to panic. It is a reason to ask your host or web developer for evidence that the right fixes are running, rather than assuming someone else has handled it.
What happened, in plain English?
On 21 October 2026, PHP released fixes for CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. These flaws can let an attacker run code without logging in. PHP says all installations serving web requests need attention, with Apache’s mod_php at highest demonstrated risk. Exposure does not establish that a site has been compromised. (PHP security advisory)
The original fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Some providers supply security backports: repairs added to older packages. Ask for confirmation covering both CVEs, not just a version number. (PHP)
CISA added both flaws to its Known Exploited Vulnerabilities catalogue on 26 October. It urges immediate patching and says affected systems that cannot be updated should be taken offline until repaired. (CISA alert)
Where AI fits — without the hype
Researchers reported that AI helped develop working PHP exploits. Separately, CrowdStrike found that in January–June 2026, 88% of the exploitation it observed involving vulnerabilities with public proof-of-concept code occurred within 48 hours of that code’s release. This is not a measure of all attacks or proof AI caused them. (Research reporting; CrowdStrike)
The takeaway: urgent security fixes cannot wait for a monthly maintenance slot. Clear responsibility for updates matters more than the latest security buzzword.
Why this matters for Australian SMEs
On shared or managed hosting, your provider may control PHP while your developer manages WordPress. Make the handover explicit: website maintenance and server patching are different jobs.
The Government’s summary of ASD’s 2025–26 Annual Cyber Threat Report puts small businesses’ average self-reported cybercrime cost at A$55,400. That is not a forecast for your business or a PHP2Shell-specific loss. It recommends replacing or mitigating legacy technology and preparing for AI-enabled threats. (business.gov.au)
What should businesses do now?
1. Get written confirmation today. Ask which PHP package is serving your site, whether both fixes are included, and whether services were restarted. Include staging and forgotten sites. Installing an update does not replace processes already running. (CISA; Tenable)
2. Check the follow-up. PHP’s 23 October advisory identified a separate, unusual session upload-progress issue, CVE-2026-115560. Ask your provider to assess the guidance, including whether upload progress should stay disabled until the next regular bugfix release. (PHP follow-up advisory)
3. Give legacy PHP an exit plan. PHP 8.1 and older are outside upstream support, although vendor backports exist. PHP 8.2 security support ends on 31 December 2026. Plan a tested upgrade to a supported branch appropriate for your site. (PHP; Support timetable)
4. Treat the firewall as an extra layer. Cloudflare deployed protections for WAF customers, including free plans, but still says to patch. Follow-up protection has configuration limits, including a changed upload-progress field name. Ask your provider to confirm coverage. (Cloudflare)
5. Check for earlier compromise. Ask your provider to review suspicious activity; patching does not undo an earlier break-in. Keep website software current, remove unused add-ons, enable administrative MFA and test backups. These support the PHP repair, rather than replace it. (CISA)
Our take
At the B.I.T Collective, our take is practical: you should not need to become a security researcher to know your website is maintained. You do need a named owner, documented patch status and a plan for anything that cannot be fixed immediately.
Send one email: “Please confirm both PHP2Shell fixes are running, the follow-up guidance has been assessed, and signs of compromise have been reviewed.” Calm, documented action beats panic and “she’ll be right”.
If you suspect an incident or need assistance, contact the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). (ASD’s ACSC)
Sources
Sources are linked alongside the claims. Cross-checked on 4 November 2026. General guidance only: your provider must assess your actual environment.