In This Guide
By Harsimran (Harry) Singh, Director · CCNA R&S, ITIL 4, MCSA, ACS Certified Professional · Updated 22 October 2026
A web designer built you a site a few years back, it ticks along on someone's hosting, and now the news says PHP has a critical flaw. If that's your situation in Perth, this page is for you: what's happened, how to see whether you're caught up in it in about five minutes, and who actually has to fix it.
Want every detail — server settings, exact fixes and all? Read our full Geeks Brisbane guide to the php2shell PHP vulnerability. This page is the short, local version, as at 22 October 2026.
1. What Happened
On 21 October 2026, the PHP project released fixes for two critical security flaws, nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). Both are rated 9.2 out of 10 (CVSS v4.0, critical). Either one can allow unauthenticated remote code execution — in plain English, someone on the internet may be able to run their own code on the web server that hosts your website, without ever logging in.
The important part: this is a bug in PHP itself, the programming language behind WordPress, WooCommerce, Joomla, Drupal, Magento and most cPanel and Plesk hosting. It is not a fault in your plugin or theme, and keeping WordPress up to date does not remove it. The fix is a new PHP build installed on the server. PHP's own advice: there are no complete mitigations, updating is the only safe choice.
Security firms are reporting early attack attempts, and exploit code is circulating. Treat it as urgent — calmly.
2. Check Your PHP Version in Five Minutes
WordPress (easiest)
- Log in to your WordPress dashboard (usually yourwebsite.com.au/wp-admin).
- Go to Tools → Site Health, then click the Info tab.
- Open the Server section and find PHP version. Write down the full number, for example 8.3.30.
- Compare it with the table below. If the last number is lower than the fixed version for your branch, you are not patched yet.
cPanel hosting
Go to Software → Select PHP Version (CloudLinux) or MultiPHP Manager. This shows the branch (for example 8.4). The exact patch number (8.4.27) may only appear in a phpinfo page or from your host — so ask them.
Plesk hosting
Go to Websites & Domains → PHP Settings and read the PHP version.
What counts as patched
| PHP branch | Fixed version | Notes |
|---|---|---|
| PHP 8.5 | 8.5.12 or newer | Supported |
| PHP 8.4 | 8.4.27 or newer | Supported |
| PHP 8.3 | 8.3.36 or newer | Supported |
| PHP 8.2 | 8.2.35 or newer | Reaches end of life on 31 December 2026 — plan a move to 8.3 or newer |
| PHP 8.1 and older | No official fixed release | End of life. PHP published minimal source backports for 7.4, 8.0 and 8.1 only (build-from-source). Some distributions and long-term-support vendors ship their own backported builds — ask yours. |
3. Message Your Host (Copy and Paste)
On shared or managed hosting you usually can't patch PHP yourself — your host has to. So your job is to ask clearly, get an answer in writing, and then verify. Copy, paste and fill in the square brackets:
Subject: Urgent: PHP security update (php2shell) for my website [your domain]
Hi,
PHP published critical security fixes on 21 October 2026 for two vulnerabilities nicknamed "php2shell" (CVE-2026-109618 and CVE-2026-109619). My website is [your domain], account/username [if you know it]. Could you please tell me:
- Which PHP version, and exact patch build, is my site running right now?
- When will you install (or when did you install) PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or a vendor-supported fix if my site is on an older PHP branch?
- Have the PHP workers been restarted since the update was installed?
- What interim protection (for example WAF rules) is in place until then?
- Have you checked my account for signs of compromise?
Please reply in writing so I have a record. Thank you.
[Your name] · [Your phone number]
As at 22 October 2026, cPanel's EasyApache 4 fixed PHP builds have been released for all versions, Plesk Obsidian updates are available, and CloudLinux's alternative PHP builds are rolling out. That doesn't tell you whether your host has installed them yet — which is why you ask.
4. Signs Something May Be Wrong
Most sites will show nothing at all, and there is no need to assume the worst. But because exploit attempts are being reported, it's worth a calm check for these signs:
- New or unfamiliar files in your website folders, especially
.phpfiles inside the uploads folder - Admin users in WordPress that you didn't create
- Plugins you don't recognise, or unexpected scheduled tasks (cron jobs)
- Spam pages, strange redirects, or Google showing "This site may be hacked" (or a security issue in Search Console)
- A sudden spike in server load or outgoing traffic, or an email from your host about suspension
If you see any of them: don't just delete the odd file. Change your passwords first (hosting account, WordPress admins, database and SFTP), then restore from a clean backup if needed and scan the site — and only then patch PHP. Deleting one file while the door stays open usually means it comes back. In Australia you can report an incident and get advice from the Australian Cyber Security Centre (1300 CYBER1, or 1300 292 371).
Also worth doing while you wait: make sure your domain's Cloudflare record, if you use Cloudflare, shows the orange cloud (Proxied) — its protection rules only cover proxied traffic — and confirm you have a restorable backup stored away from the site.
5. Perth Website Owners: Getting Help
Our Perth technicians work across Fremantle, Joondalup, Rockingham, Scarborough and Stirling and the wider metro area. Most of this can be done remotely in a single session; if you prefer someone alongside you, we can come to you.
- We check which PHP version your site is running
- We contact your host for you and chase a written answer
- We check for signs of compromise
- We help turn on Cloudflare protection
- We make sure your backups work
Remote support is $125/hr and an onsite visit is $205/hr, with a one-hour minimum and no call-out fee. You'll know the cost before we start.
On shared or managed hosting only the host can install the PHP fix, and we can't promise a site is untouched. We'll tell you honestly what we find.
Book Remote Support
Send us your website address and we'll start with the PHP version check.
Book HelpRunning a business? See our business IT support and managed IT plans.
Sources
PHP security advisory, 21 October 2026 · PHP supported versions · Tenable — php2shell FAQ · Cloudflare — WAF protection for the PHP vulnerabilities · CloudLinux incident notice · Australian Cyber Security Centre (cyber.gov.au). Everything here is stated as at 22 October 2026 and may change as vendors release updates.