Tech Translated

IT Security & Technology Blog

Practical IT insights for Australian businesses. Our team covers cybersecurity advisories, compliance updates, and plain-English explainers on the technology your business relies on, published regularly as the landscape shifts.

php2shell critical PHP vulnerability warning, All IT Services
By — Head of Relationships |

php2shell: Critical PHP Flaws Put Nearly Every Website at Risk

If your business has a website, this one is for you. The PHP team is pushing out emergency patches for two critical flaws nicknamed "php2shell", and researchers expect attackers to start hitting unpatched sites within minutes of the fix going public.

On 21 October, PHP scheduled emergency fixes for two remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, after details leaked ahead of the planned disclosure. PHP rates both at 9.2 out of 10; some researchers are calling them a perfect 10. According to Dutch security firm Sansec, every web server running PHP 5.4 or later is affected. That is the vast majority of the web, including WordPress, WooCommerce, Magento and Shopware sites.

CVE Flaw Severity Affected
CVE-2026-109618 Remote code execution 9.2 Critical PHP 5.4+
CVE-2026-109619 Remote code execution 9.2 Critical PHP 5.4+

Why this matters for Australian businesses

PHP quietly powers most small business websites in Australia, whether the owner knows it or not. Remote code execution means an attacker can run their own commands on your server without a password, which is about the worst kind of bug there is. Sansec reckons mass exploitation could begin within 15 minutes of the patch going public, the same pattern the industry saw with Log4Shell a few years back.

Here is the part we see over and over with businesses across the Northern Beaches and Central West NSW: most owners have no idea which PHP version their site runs on, let alone who is responsible for patching it. That gap is the real risk. The bug is serious, but the bigger problem is a website nobody is actively looking after.

"The businesses that get burned by these aren't the ones running old software on purpose. They're the ones who assumed someone else was handling the updates."

Dan Briggs, All IT Services

What to do about it

  • Call your web host or developer today. Ask whether they have applied the PHP patch and when they expect to.
  • Check your PHP version. Anything on 8.1 or older will not get an official fix and needs a backport or an upgrade.
  • Update WordPress core, themes and plugins while you are in there. Outdated plugins are the next door attackers try.
  • Confirm you have a clean, recent backup stored off the server, so you can recover fast if something slips through.
All IT Cybersecurity services: we keep an eye on the systems your business runs on, so an emergency patch like this is already handled before you hear about it.
Timing: Patches land 21 October at 2:00pm UTC (early hours of 22 October AEDT). Attackers move fast once a fix is public, so do not sit on this.
Sources PHP warns admins of two critical flaws, emergency patches coming, BleepingComputer
Critical PHP RCE: CVE-2026-109618 and CVE-2026-109619 (php2shell), Sansec

Written by Dan Briggs, All IT Services. All IT is a Sydney-based managed IT provider supporting small and medium businesses across the Northern Beaches, wider Sydney, Central West NSW, Brisbane and Melbourne.

Frequently Asked Questions

php2shell is the nickname for two critical remote code execution flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. They affect web servers running PHP 5.4 or later, which covers most websites online. PHP released emergency patches on 21 October 2026.
Almost certainly. WordPress, WooCommerce, Magento and Shopware all run on PHP, so any site built on them sits on a vulnerable version until the server is patched. The fix is applied at the server level, not inside WordPress, so your host or developer needs to action it.
Contact your web host or developer today and ask two things: have they applied the PHP patch, and what PHP version your site runs on. Reputable hosts will patch quickly, but it is worth confirming rather than assuming.
PHP only officially supports version 8.2 and later. If you are on 8.1 or older you will not get an official fix, so you need your provider to backport the patch or move you to a supported version. Running unsupported PHP is a risk well beyond this one bug.

Not sure who patches your website?

If you cannot answer that in one sentence, let's talk. We will check what your site runs on and make sure critical fixes like php2shell are handled for you.

Talk to All IT Our Cybersecurity Services

Related Guide

Cybersecurity for Sydney SMBs

Explore our complete guide to protecting your business from cyber threats.

Read the Full Guide →
Posted in cybersecurity-advisory Security

About All IT Services

We’re a leading IT specialist providing premium services and support to businesses across Australia’s eastern seaboard. Our strength lies in our size – big enough to tackle complex projects yet small enough to pick up the phone when you call.  At All IT Services, our approach is refreshingly straightforward - no endless wait times or tech jargon. Just real people with genuine passion and expertise in IT solutions.

CONTACT US