In This Guide
By Harsimran (Harry) Singh, Director · CCNA R&S, ITIL 4, MCSA, ACS Certified Professional · Updated 22 October 2026
If your Sydney business has a website — a tradie's booking site, an online shop, a clinic or café page someone built for you a few years ago — you may have seen the "critical PHP flaw" headlines and wondered whether it lands on you. Short answer: if the site runs PHP, it might, and the fix is mostly a conversation with whoever hosts it. Here's the plain-English version for Sydney owners.
Want every detail — server settings, exact fixes and all? Read our full Geeks Brisbane guide to the php2shell PHP vulnerability. This page is the short, local version, as at 22 October 2026.
1. What Happened
On 21 October 2026, the PHP project released fixes for two critical security flaws, nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 (CVSS v4.0, critical). Either one can allow unauthenticated remote code execution — in plain English, someone on the internet may be able to run their own code on the web server that hosts your website, without ever logging in.
The important part: this is a bug in PHP itself, the programming language behind WordPress, WooCommerce, Joomla, Drupal, Magento and most cPanel and Plesk hosting. It is not a fault in your plugin or theme, and keeping WordPress up to date does not remove it. The fix is a new PHP build installed on the server. PHP's own advice: there are no complete mitigations, updating is the only safe choice.
Security firms are reporting early attack attempts, and exploit code is circulating. Treat it as urgent — calmly.
2. Check Your PHP Version in Five Minutes
WordPress (easiest)
- Log in to your WordPress dashboard (usually yourwebsite.com.au/wp-admin).
- Go to Tools → Site Health, then click the Info tab.
- Open the Server section and find PHP version. Write down the full number, for example 8.3.30.
- Compare it with the table below. If the last number is lower than the fixed version for your branch, you are not patched yet.
cPanel hosting
Go to Software → Select PHP Version (CloudLinux) or MultiPHP Manager. This shows the branch (for example 8.4). The exact patch number (8.4.27) may only appear in a phpinfo page or from your host — so ask them.
Plesk hosting
Go to Websites & Domains → PHP Settings and read the PHP version.
What counts as patched
| PHP branch | Fixed version | Notes |
|---|---|---|
| PHP 8.5 | 8.5.12 or newer | Supported |
| PHP 8.4 | 8.4.27 or newer | Supported |
| PHP 8.3 | 8.3.36 or newer | Supported |
| PHP 8.2 | 8.2.35 or newer | Reaches end of life on 31 December 2026 — plan a move to 8.3 or newer |
| PHP 8.1 and older | No official fixed release | End of life. PHP published minimal source backports for 7.4, 8.0 and 8.1 only (build-from-source). Some distributions and long-term-support vendors ship their own backported builds — ask yours. |
3. Message Your Host (Copy and Paste)
On shared or managed hosting you usually can't patch PHP yourself — your host has to. So your job is to ask clearly, get an answer in writing, and then verify. Copy, paste and fill in the square brackets:
Subject: Urgent: PHP security update (php2shell) for my website [your domain]
Hi,
PHP published critical security fixes on 21 October 2026 for two vulnerabilities nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). My website is [your domain], account/username [if you know it]. Could you please tell me:
- Which PHP version, and exact patch build, is my site running right now?
- When will you install (or when did you install) PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-supported fix if my site is on an older PHP branch?
- Have the PHP workers been restarted since the update was installed?
- What interim protection (for example WAF rules) is in place until then?
- Have you checked my account for signs of compromise?
Please reply in writing so I have a record. Thank you.
[Your name] · [Your phone number]
As at 22 October 2026, cPanel's EasyApache 4 fixed PHP builds have been released for all versions, Plesk Obsidian updates are available, and CloudLinux's alternative PHP builds are rolling out. That doesn't tell you whether your host has installed them yet — which is why you ask.
4. Signs Something May Be Wrong
Most sites will show nothing at all, and there is no need to assume the worst. But because exploit attempts are being reported, it's worth a calm check for these signs:
- New or unfamiliar files in your website folders, especially
.phpfiles inside the uploads folder - Admin users in WordPress that you didn't create
- Plugins you don't recognise, or unexpected scheduled tasks (cron jobs)
- Spam pages, strange redirects, or Google showing "This site may be hacked" (or a security issue in Search Console)
- A sudden spike in server load or outgoing traffic, or an email from your host about suspension
If you see any of them: don't just delete the odd file. Change your passwords first (hosting account, WordPress admins, database and SFTP), then restore from a clean backup if needed and scan the site — and only then patch PHP. Deleting one file while the door stays open usually means it comes back. In Australia you can report an incident and get advice from the Australian Cyber Security Centre (1300 CYBER1, or 1300 292 371).
Also worth doing while you wait: make sure your domain's Cloudflare record, if you use Cloudflare, shows the orange cloud (Proxied) — its protection rules only cover proxied traffic — and confirm you have a restorable backup stored away from the site.
5. How We Help Sydney Website Owners
Most of the Sydney owners who ring us don't know who hosts their site, or what PHP is. That's fine — start with your domain name and we'll work backwards. We work with people across Parramatta, Chatswood, Bondi, North Sydney and Penrith and the wider Sydney area, remotely or in person.
- We check which PHP version your site is running
- We contact your host for you and chase a written answer
- We check for signs of compromise
- We help turn on Cloudflare protection
- We make sure your backups work
Remote support is $125/hr and an onsite visit is $205/hr, with a one-hour minimum and no call-out fee. You'll know the cost before we start.
On shared or managed hosting only the host can install the PHP fix, and we can't promise a site is untouched. We'll tell you honestly what we find.
Book Remote Support
Send us your website address and we'll start with the PHP version check.
Book HelpRunning a business? See our business IT support and managed IT plans.
Sources
PHP security advisory, 21 October 2026 · PHP supported versions · Tenable — php2shell FAQ · Cloudflare — WAF protection for the PHP vulnerabilities · CloudLinux incident notice · Australian Cyber Security Centre (cyber.gov.au). Everything here is stated as at 22 October 2026 and may change as vendors release updates.