PHP Security Flaw (php2shell): What Adelaide Website Owners Need to Do
Two critical PHP bugs were fixed on 21 October 2026. For Adelaide website owners and small businesses.
By Harsimran (Harry) Singh, Director · CCNA R&S, ITIL 4, MCSA, ACS Certified Professional · Updated 22 October 2026
If you run a website from Adelaide — a trade business, a shop, a community page — and it's built on WordPress or anything else that uses PHP, two newly released security fixes matter to you. The good news is that for most people the real work is one email to their web host and one quick version check. We've laid out both below in plain English.
Want every detail — server settings, exact fixes and all? Read our full Geeks Brisbane guide to the php2shell PHP vulnerability. This page is the short, local version, as at 22 October 2026.
What Happened
On 21 October 2026, the PHP project released fixes for two critical security flaws, nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 (CVSS v4.0, critical). Either one can allow unauthenticated remote code execution — in plain English, someone on the internet may be able to run their own code on the web server that hosts your website, without ever logging in.
The important part: this is a bug in PHP itself, the programming language behind WordPress, WooCommerce, Joomla, Drupal, Magento and most cPanel and Plesk hosting. It is not a fault in your plugin or theme, and keeping WordPress up to date does not remove it. The fix is a new PHP build installed on the server. PHP's own advice: there are no complete mitigations, updating is the only safe choice.
How urgent? Security firms are reporting early attack attempts, and exploit code is circulating. Treat it as urgent — calmly.
Check Your PHP Version in Five Minutes
WordPress (easiest)
- Log in to your WordPress dashboard (usually yourwebsite.com.au/wp-admin).
- Go to Tools → Site Health, then click the Info tab.
- Open the Server section and find PHP version. Write down the full number, for example 8.3.30.
- Compare it with the table below. If the last number is lower than the fixed version for your branch, you are not patched yet.
cPanel hosting
Go to Software → Select PHP Version (CloudLinux) or MultiPHP Manager. This shows the branch (for example 8.4). The exact patch number (8.4.27) may only appear in a phpinfo page or from your host — so ask them.
Plesk hosting
Go to Websites & Domains → PHP Settings and read the PHP version.
What counts as patched
| PHP branch | Fixed version | Notes |
|---|---|---|
| PHP 8.5 | 8.5.12 or newer | Supported |
| PHP 8.4 | 8.4.27 or newer | Supported |
| PHP 8.3 | 8.3.36 or newer | Supported |
| PHP 8.2 | 8.2.35 or newer | Reaches end of life on 31 December 2026 — plan a move to 8.3 or newer |
| PHP 8.1 and older | No official fixed release | End of life. PHP published minimal source backports for 7.4, 8.0 and 8.1 only (build-from-source). Some distributions and long-term-support vendors ship their own backported builds — ask yours. |
Message Your Host (Copy and Paste)
On shared or managed hosting you usually can't patch PHP yourself — your host has to. So your job is to ask clearly, get an answer in writing, and then verify. Copy, paste and fill in the square brackets:
Subject: Urgent: PHP security update (php2shell) for my website [your domain]
Hi,
PHP published critical security fixes on 21 October 2026 for two vulnerabilities nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). My website is [your domain], account/username [if you know it]. Could you please tell me:
- Which PHP version, and exact patch build, is my site running right now?
- When will you install (or when did you install) PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-supported fix if my site is on an older PHP branch?
- Have the PHP workers been restarted since the update was installed?
- What interim protection (for example WAF rules) is in place until then?
- Have you checked my account for signs of compromise?
Please reply in writing so I have a record. Thank you.
[Your name] · [Your phone number]
As at 22 October 2026, cPanel's EasyApache 4 fixed PHP builds have been released for all versions, Plesk Obsidian updates are available, and CloudLinux's alternative PHP builds are rolling out. That doesn't tell you whether your host has installed them yet — which is why you ask.
Signs Something May Be Wrong
Most sites will show nothing at all, and there is no need to assume the worst. But because exploit attempts are being reported, it's worth a calm check for these signs:
- New or unfamiliar files in your website folders, especially
.phpfiles inside the uploads folder - Admin users in WordPress that you didn't create
- Plugins you don't recognise, or unexpected scheduled tasks (cron jobs)
- Spam pages, strange redirects, or Google showing "This site may be hacked" (or a security issue in Search Console)
- A sudden spike in server load or outgoing traffic, or an email from your host about suspension
If you see any of them: don't just delete the odd file. Change your passwords first (hosting account, WordPress admins, database and SFTP), then restore from a clean backup if needed and scan the site — and only then patch PHP. Deleting one file while the door stays open usually means it comes back. In Australia you can report an incident and get advice from the Australian Cyber Security Centre (1300 CYBER1, or 1300 292 371).
Also worth doing while you wait: make sure your domain's Cloudflare record, if you use Cloudflare, shows the orange cloud (Proxied) — its protection rules only cover proxied traffic — and confirm you have a restorable backup stored away from the site.
Website Help for Adelaide and South Australia
We help Adelaide and South Australia website owners remotely, and on site across the metro area. If you're not sure where your site is hosted, that's our first job.
- We check which PHP version your site is running
- We contact your host for you and chase a written answer
- We check for signs of compromise
- We help turn on Cloudflare protection
- We make sure your backups work
Remote support is $125/hr and an onsite visit is $205/hr, with a one-hour minimum and no call-out fee. You'll know the cost before we start.
What we can't do On shared or managed hosting only the host can install the PHP fix, and we can't promise a site is untouched. We'll tell you honestly what we find.
Running a business? See our business IT support and managed IT plans.
Common questions
"php2shell" is the nickname for two critical bugs in PHP (CVE-2026-109618 and CVE-2026-109619), the language most websites run on, including WordPress and WooCommerce. Both are rated 9.2 out of 10 (CVSS v4.0) and can let an attacker run code on the web server without logging in. PHP released fixes on 21 October 2026. Your site is at risk if it runs on PHP and your host hasn't installed the fixed build yet. Keeping WordPress, your theme and plugins up to date doesn't remove it, because the flaw is in PHP itself. The fix is a new PHP build on the server.
It depends on your hosting. On shared or managed hosting (cPanel, Plesk, managed WordPress) your host has to install the fixed PHP build. On your own VPS, dedicated or cloud server it's you or your IT provider, followed by a restart of PHP-FPM, Apache or LiteSpeed.
In WordPress go to Tools → Site Health → Info → Server and read "PHP version". On cPanel use Select PHP Version or MultiPHP Manager; on Plesk use Websites & Domains → PHP Settings. Those may show only the branch, so ask your host for the exact patch build.
It can, which is why you back up first and test afterwards. Settings such as memory_limit are per PHP version and don't carry over when you change branch.
On shared or managed hosting we can't install PHP on your host's server — only the host can. What we do is check your version, send your host the right questions and chase the answer, check for signs of compromise, help turn on Cloudflare protection and make sure your backups work. Remote support is $125/hr and an onsite visit is $205/hr, both with a one-hour minimum and no call-out fee. You'll know the cost before we start.
Sources
PHP security advisory, 21 October 2026 · PHP supported versions · Tenable — php2shell FAQ · Cloudflare — WAF protection for the PHP vulnerabilities · CloudLinux incident notice · Australian Cyber Security Centre (cyber.gov.au). Everything here is stated as at 22 October 2026 and may change as vendors release updates.
Book an Adelaide technician
$205/hr on site, $125/hr remote, no call-out fee, one-hour minimum.
Book OnlinePlease note: this guide is general information as at 22 October 2026, drawn from PHP and vendor advisories, and makes no promises about any particular website. Rates shown are our own published rates.