Critical PHP Vulnerability (CVE-2026-109618): What Australian Businesses Need To Do Now

Most business owners never think about what their website runs on. It loads, the enquiry form works, and that’s the end of it. This week, that changed. Two critical flaws in PHP, the language behind WordPress and most of the web, were made public on 21 October 2026, and they let an attacker take complete control of the server a website sits on.

This PHP vulnerability is serious because of how widely PHP is used. If your site runs on WordPress, WooCommerce, Drupal, Laravel or a custom build, it almost certainly uses PHP. Patches are available now, but they only protect you once they’ve been applied. If you need a hand, our website development team can check and patch your site for you.

Below is what happened, how to tell if you’re affected and the practical steps to reduce your risk today.

What Is The PHP Vulnerability?

Two remote code execution (RCE) vulnerabilities have been tracked as CVE-2026-109618 and CVE-2026-109619. Remote code execution means an attacker can run their own commands on your server from anywhere on the internet, without needing a login.

Why it’s rated critical

• Full server takeover. An attacker can read, change or delete anything on the server, including customer data.
• Exploit code is public. Proof-of-concept code is already circulating, so attackers don’t need to work out how to use the flaw themselves.
• No complete workaround. Updating PHP to a patched version is the only safe fix.

Why speed matters

Hacking is now largely automated. Bots scan the internet for unpatched sites within hours of a disclosure like this, and they don’t care how big or small your business is. A compromised site doesn’t always look broken, either. Attackers often stay quiet and harvest data or plant malicious code in the background, so you may not know you’ve been breached.

Is Your Website Affected?

The flaws affect every version of PHP from PHP 5 onward. If you run PHP anywhere in your business, assume you’re in scope until you’ve confirmed it’s patched.

The patched PHP versions

• PHP 8.5.12
• PHP 8.4.27
• PHP 8.3.36
• PHP 8.2.35

Anything older than these within the same branch is vulnerable. You can confirm the release details in the official PHP changelog.

If you’re on PHP 8.1 or earlier

Patches are only being released for supported versions, which means 8.2 and later. PHP 8.1 and earlier are end of life and won’t get a fix. If your site runs on one of these, you need to upgrade to PHP 8.2 or later before you can patch. Older plugins and themes sometimes break on a newer PHP version, so test the upgrade on a staging copy first.

How to check your PHP version

• WordPress: go to Tools > Site Health > Info > Server. Your PHP version is listed there.
• cPanel hosting: look for “Select PHP Version” or “MultiPHP Manager”.
• Not sure: ask your hosting provider or developer directly. They should be able to answer the same day.

What To Do Now To Reduce Your Risk

1. Patch PHP immediately

Update PHP to one of the patched versions above. On managed hosting, your host may do this for you, but don’t assume it. Ask them to confirm in writing.

2. Update the software that runs on PHP

WordPress, Laravel, Drupal and other platforms may release their own patches in response. Update the core software, then every plugin and theme. Take a full backup before you start so you can roll back if something breaks.

3. Reduce exposure if you can’t patch today

The PHP Foundation has published interim measures that reduce exposure to specific attack paths. These measures don’t make your site safe, but they buy time while you plan the update:

• Restrict public access to any PHP application that doesn’t need to be on the internet, such as staging sites, admin tools and old microsites.
• Make sure a firewall or web application firewall (WAF) is in place and its rules are current.
• Turn on monitoring and alerts so unusual activity is picked up quickly.

4. Check for signs of compromise

Because a breach can be silent, check for:

• New administrator users you didn’t create.
• Unfamiliar files or recently changed files on the server.
• Unexpected redirects, pop-ups or spam pages on your site.
• Security warnings in Google Search Console or from your browser.
• Spikes in outgoing email from your domain.

5. Tighten access after patching

If anything looks off, or you patched late, change hosting, database, FTP and admin passwords, and turn on two-factor authentication wherever it’s offered. Our guide on how to keep your site safe from data breaches covers the longer-term habits that reduce your risk next time.

Common Mistakes To Avoid

• Assuming your host has handled it. Many hosts patch quickly, but some leave PHP versions up to the customer. Confirm it.
• Updating WordPress but not PHP. These are two separate layers, and the vulnerability sits in PHP itself.
• Forgetting old sites. Landing pages, microsites and staging copies on the same server are just as exposed as your main site.
• Relying on a firewall alone. A firewall reduces exposure but doesn’t fix the flaw.
• Upgrading without a backup. A failed upgrade without a backup can take a site offline for days.

How SBM Can Help With The PHP Vulnerability

If your website is hosted and managed by Smith Brothers Media, our team is already on it, and you don’t need to do anything.

If your site is hosted elsewhere, or you’re not sure where it stands, we can help today. Our tech team works around the clock to:

• Check your PHP version.
• Apply the patch or upgrade end-of-life versions.
• Update WordPress and your plugins.
• Look for signs of compromise.

We work commercially and quickly: you sign a simple one-page agreement, and we start straight away.

Get your site checked and someone from our team will call you back as soon as possible, or contact our support team on 1300 721 137.