Two critical PHP security vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 for severity, can let an attacker run malicious code on a web server without any username or password. Because PHP powers millions of sites, including WordPress, Drupal and Joomla, Australian businesses must confirm their hosting has applied the patch, not just that WordPress is up to date.
On 21 October 2026 the Australian Signals Directorate’s Australian Cyber Security Centre issued a critical alert, and the PHP team released emergency updates. Some government sites and major websites went offline as a precaution. Here is what happened, why it matters, and the exact steps to protect your website.
Quick answer: Two critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2) allow unauthenticated remote code execution on unpatched servers. Patches were released on 21 October 2026. The only safe fix is to update PHP on your hosting server; updating WordPress alone does not protect you. Confirm with your hosting provider that the patch has been applied, keep all software current, enable multifactor authentication, and maintain tested backups.
What Happened: Two Critical Security Flaws Discovered in PHP
On 21 October 2026, the PHP development team released emergency security updates addressing two newly disclosed vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both received a critical CVSS v4.0 severity rating of 9.2.
The flaws could allow what cybersecurity professionals call unauthenticated remote code execution. In simple terms, an attacker may be able to send a malicious request to a vulnerable website and cause the server to run code without first logging in. Website login protection alone cannot prevent an attack that exploits the underlying PHP runtime.
According to the official PHP advisory, affected environments may include websites running PHP through Apache, PHP-FPM, LiteSpeed, CGI and other supported server configurations. The PHP team has warned that there are no complete alternative mitigations and that updating is the only safe way to address the vulnerabilities.
Official source: PHP Security Release Announcement.
Why This Became a Global Cybersecurity Concern
Unlike a weakness affecting one plugin or a single application, these vulnerabilities exist within PHP itself, which makes the potential exposure far broader. A business might have an updated WordPress website, well-maintained plugins and strong administrator passwords, yet still face risk if the PHP software on its hosting server has not been patched.
Websites taken offline as a precaution
The BBC reported on 21 October 2026 that websites and services associated with organisations including the Finnish government, Edinburgh council and the BBC were taken offline ahead of the security updates. Temporarily restricting access can reduce exposure when a critical weakness cannot be patched immediately. A site going offline as a precaution does not necessarily mean it has been attacked or compromised.
Australian Government issues a critical alert
The Australian Cyber Security Centre published a critical alert on 21 October 2026. The initial advisory warned that PHP versions dating back to PHP 5 could potentially be affected, and instructed organisations to identify PHP installations in their environments, follow official PHP announcements, apply the relevant updates, and monitor systems for suspicious activity. At the time of publication, the ACSC stated it was not aware of active exploitation. A critical vulnerability can still present a serious risk before widespread attacks are confirmed.
Why These PHP Vulnerabilities Are So Dangerous
When someone visits a website, submits an enquiry form, logs into an account or makes a purchase, PHP may process parts of that request on the server, interacting with databases, customer information, files and other business systems. If an attacker exploits a critical flaw in the PHP runtime, the consequences can extend well beyond how the website looks.
1. Unauthorised access to sensitive customer information
Many sites collect information through contact forms, booking systems, customer accounts and transactions. Depending on what is stored and how the server is configured, an attacker who compromises a server could access customer details or business records, creating a data privacy incident and challenges around customer trust, incident response and privacy obligations.
2. Website takeover or malicious content
An attacker with sufficient control of a server may change website files or interfere with how the site operates, resulting in unwanted advertisements, malicious redirects, fake login pages or altered content. For businesses that rely on their website for lead generation or online sales, this interrupts enquiries and damages brand credibility.
3. Theft of passwords and API credentials
Websites often rely on confidential information in server configurations, including database credentials, email authentication details and API keys for third-party platforms. If an attacker gains access to those credentials, the consequences can extend into other connected business systems.
4. Website downtime and business disruption
Not every attack steals information. Some aim to disrupt services or lock a business out of its own website. For an online store, downtime interrupts transactions; for a service business, it means missed enquiries and lost bookings. Businesses running ads may keep paying for traffic sent to a site that is unavailable or broken.
5. Malware and further attacks
A compromised server could be used to host malicious content, distribute malware, or serve as a starting point for attacks on connected systems. An attacker may also establish persistent access, so applying a patch is essential but may not be enough if a site has already been compromised.
Government guidance: Australian Cyber Security Centre, Secure Your Website.
Are WordPress Websites Affected?
WordPress is built using PHP, so its security depends partly on the version and configuration of PHP running on the web server. Other PHP-based systems, including Drupal and Joomla, may also be exposed when hosted on vulnerable PHP environments. Using WordPress does not automatically mean a site has been hacked; whether a particular site is still vulnerable depends on its PHP version, the patches applied by the hosting provider and the server configuration.
Why updating WordPress alone is not enough
Many owners assume automatic WordPress updates are enough. Maintaining the WordPress core, themes and plugins matters, but it does not guarantee the PHP software on the server has been updated. These are separate components: WordPress updates address the website application, while PHP security releases address the programming language runtime. For this incident, the hosting environment must receive the applicable PHP fix, and if a third-party provider hosts your site, they may be responsible for installing it. Confirm the update has been completed rather than assuming it happened automatically.
Which PHP Versions Need to Be Updated
On 21 October 2026, the PHP development team released security patches for its supported version branches. Businesses running earlier releases within these branches should arrange the applicable updates immediately.
PHP branch
What to do now
Supported branches (current)
Update to the latest patched release within your branch immediately.
PHP 8.2
Patch now, then plan an upgrade: 8.2 reaches end of life on 31 December 2026.
PHP 5, 7 and other unsupported versions
No longer receive security fixes; upgrade to a supported, patched branch.
Some hosting providers deliver security fixes through their own supported packages. Where this applies, obtain confirmation that the vulnerability has been addressed rather than relying on the visible PHP version number alone.
Official source: PHP Releases and Security Updates.
How Australian Businesses Can Protect Their Websites
The most important immediate action is to confirm that the underlying PHP environment has been patched. This incident is also a good moment to review broader website security. The following steps are consistent with Australian Cyber Security Centre guidance.
1. Contact your website hosting provider
If you are unsure which PHP version your website uses, ask your hosting provider or developer to confirm: which PHP version is running, whether the fixes for CVE-2026-109618 and CVE-2026-109619 have been applied, whether all websites on the environment are covered, and whether the environment has been reviewed for suspicious activity.
2. Apply the latest PHP security patches
Updating to a patched PHP release is the primary protection. If your provider manages PHP updates, request confirmation the patch is installed. Businesses managing their own servers should have qualified staff apply the updates and verify the patched software is running. Compatibility testing matters, but should be prioritised so critical updates are not delayed unnecessarily.
3. Keep your website software updated
Although updating WordPress alone cannot fix this PHP flaw, maintaining the rest of your software remains essential. Outdated plugins, themes and content management systems introduce extra weaknesses. Review installed software regularly, remove what is no longer needed, and apply security updates promptly.
4. Strengthen website access security
The ACSC recommends enabling multifactor authentication for administrator accounts. Use strong, unique passwords and limit administrator access to people who genuinely need it. These steps reduce the risk of account compromise, though they cannot replace the PHP patch in this incident.
5. Maintain secure website backups
A reliable backup makes a significant difference when recovering from damage, data loss or a cyberattack. Perform backups regularly, store them securely, and test restoration. Where practical, keep backup copies separate from the primary hosting environment so a single incident cannot affect both.
6. Monitor website activity
Security does not stop once a patch is installed. Watch for warning signs: unexpected changes to pages or files, unknown administrator accounts, unexplained redirects, unusual server activity or file uploads, changed hosting configurations, and reports of suspicious behaviour from visitors. A professional technical review may be needed to confirm whether these indicate a real compromise.
7. Review your hosting and maintenance arrangements
Understand who is responsible for your website’s security. Depending on the arrangement, responsibilities may be split between the hosting provider, developer, IT provider and business owner. Clarifying this helps ensure important security updates are not overlooked.
Government guidance: Secure Your Website, official ACSC guidance.
What If Your Website Has Already Been Compromised?
If you believe your website may have been attacked, acting quickly can limit further damage, but the response should be coordinated carefully to avoid destroying useful evidence or making recovery harder.
- Contact your hosting provider or technical team. Notify the people responsible so they can assess the problem and decide whether the website or affected systems need to be isolated.
- Investigate suspicious activity. Review server logs, website files and account activity to identify unauthorised changes, and preserve relevant evidence before making major changes.
- Contain the threat and apply security fixes. Address the vulnerability and remove any unauthorised access; investigate and resolve malicious files or unknown accounts.
- Review and replace exposed credentials. Revoke or change any passwords, API keys or database credentials that may have been exposed, timed with the incident response.
- Restore and monitor the website. Where restoration is needed, use a verified clean backup, confirm the environment is secure, and keep monitoring afterwards.
- Seek official cybersecurity assistance. The ACSC provides incident guidance and support on 1300 CYBER1 (1300 292 371). If personal information may have been exposed, assess your notification and reporting obligations.
Government guidance: ACSC, how we help during a cyber security incident.
The Growing Role of Artificial Intelligence in Cybersecurity
Another notable aspect of this incident is the reported involvement of artificial intelligence in identifying the vulnerabilities. AI-assisted security research can analyse large amounts of code and surface weaknesses more efficiently. According to the BBC’s coverage, the PHP vulnerabilities were identified with the help of AI, highlighting the growing role of these tools in cybersecurity research.
The same developments can create opportunities for cybercriminals, who may use AI to research vulnerabilities, develop attacks or automate parts of their operations. This does not mean AI independently hacked millions of websites; it means AI-assisted tools played a role in discovering serious weaknesses that could be exploited.
What the Australian Government says about AI-enabled cyber threats
In July 2026, the ACSC published guidance addressing AI-enabled cyberattacks and their implications for small businesses. It recommends that businesses ensure their website software is supported and receives updates, identify who is responsible for website cybersecurity, disable functionality that is no longer required, understand how quickly their maintainer can detect and respond to an attack, and maintain reliable backups and recovery arrangements.
Government guidance: Defending against AI-enabled cyber attacks, guidance for small businesses.
Why Website Security Matters Beyond This Incident
A business website is often one of its most important digital assets. It attracts customers through Google searches, generates enquiries from advertising, accepts payments, processes bookings and manages sensitive information. A serious security incident can interfere with everyday business activities, damage customer confidence and create unexpected recovery costs.
These PHP vulnerabilities show that even widely used technologies can contain critical weaknesses, and they reinforce why security needs ongoing attention rather than occasional updates. Maintaining supported software, applying patches promptly, monitoring activity and having an incident response plan are core parts of responsible website management.
Final Thoughts: Staying Informed and Staying Protected
The discovery of two critical PHP vulnerabilities has prompted urgent responses from cybersecurity authorities, software developers and website operators worldwide. Although official patches are available, the responsibility remains with website owners and their service providers to confirm that affected environments have been updated.
For Australian businesses using WordPress or other PHP-based platforms, the immediate priority is to verify the PHP security status of their website and address any outstanding vulnerabilities. More broadly, this incident is a reminder that cybersecurity is an ongoing responsibility. At Webco, we will keep sharing important technology developments, official cybersecurity alerts and practical information to help Australian businesses stay informed.
Frequently Asked Questions
What are the PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619?
They are two critical PHP security flaws disclosed on 21 October 2026, both rated 9.2 out of 10 (CVSS v4.0). They can allow unauthenticated remote code execution, meaning an attacker may send a malicious request to a vulnerable website and cause the server to run code without logging in. The PHP team has released patches and warns that updating is the only safe fix.
Are WordPress websites affected by the PHP vulnerabilities?
WordPress is built on PHP, so a WordPress site can be exposed if the PHP version on its hosting server is unpatched. Drupal, Joomla and other PHP-based systems may also be affected. Using WordPress does not automatically mean a site has been hacked; whether it is still vulnerable depends on the PHP version, the patches applied by the host and the server configuration.
Is updating WordPress enough to fix the PHP vulnerability?
No. Updating the WordPress core, themes and plugins addresses the website application, but not the PHP runtime on the server. These are separate components. For this incident the hosting environment must receive the applicable PHP security fix, so confirm with your hosting provider that PHP itself has been patched rather than assuming WordPress updates covered it.
What should Australian businesses do about the PHP security alert?
Confirm with your hosting provider that the PHP patches for CVE-2026-109618 and CVE-2026-109619 have been applied, keep all website software updated, enable multifactor authentication for admin accounts, maintain tested backups, and monitor for suspicious activity. These steps follow Australian Cyber Security Centre guidance; the PHP patch itself is the primary protection.
How do I know if my website's PHP has been patched?
Ask your hosting provider or developer which PHP version is running and whether the 21 October 2026 security fixes have been applied across every site on the environment. Because some hosts deliver fixes through their own packages, request written confirmation that the vulnerability has been addressed rather than relying on the visible PHP version number alone.
Worried About Your Website's PHP Security?
Webco helps Australian businesses keep their websites secure, updated and monitored. We can confirm your PHP patch status with your host, harden access, set up tested backups, and watch for suspicious activity so a critical alert like this one does not catch you out.
